CVE-2013-0263: Medium severity rack-project rack vulnerability

Published Feb 8, 2013
·
Updated

James Tucker (raggi) reports:

CVE: CVE-2013-0263 Software: Rack (rack.github.com) Type of vulnerability: Timing attack, leading to potential RCE

Vulnerable code: https://github.com/rack/rack/blob/master/lib/rack/session/cookie.rb#L149 Patch: https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07 https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11

Versions affected: All prior versions. Versions fixed: 1.1.6, 1.2.8, 1.3.10, 1.4.5, 1.5.2 Reporter: Ben Murphy

Reference: http://seclists.org/oss-sec/2013/q1/271

Other sources

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

Affected Software

42 affected componentsFixes available
redhat/candlepin<0:0.7.24-1.el6_3
0:0.7.24-1.el6_3
redhat/katello<0:1.2.1.1-1h.el6_4
0:1.2.1.1-1h.el6_4
redhat/katello-configure<0:1.2.3.1-4h.el6_4
0:1.2.3.1-4h.el6_4
redhat/rubygem-actionpack<1:3.0.10-12.el6cf
1:3.0.10-12.el6cf
redhat/rubygem-activemodel<0:3.0.10-3.el6cf
0:3.0.10-3.el6cf
redhat/rubygem-json<0:1.7.3-2.el6_3
0:1.7.3-2.el6_3
redhat/rubygem-nokogiri<0:1.5.0-0.9.beta4.el6cf
0:1.5.0-0.9.beta4.el6cf
redhat/rubygem-rack<1:1.3.0-4.el6cf
1:1.3.0-4.el6cf
redhat/rubygem-rdoc<0:3.8-6.el6cf
0:3.8-6.el6cf
redhat/thumbslug<0:0.0.28.1-1.el6_4
0:0.0.28.1-1.el6_4
redhat/jenkins<0:1.502-1.el6
0:1.502-1.el6
redhat/openshift-origin-cartridge-jenkins<1.4-0:1.0.3-1.el6
1.4-0:1.0.3-1.el6
redhat/ruby193-rubygem-rack<1:1.4.1-4.el6
1:1.4.1-4.el6
redhat/rubygem-rack<1:1.3.0-4.el6
1:1.3.0-4.el6
Rack Project Rack=1.5.0
Rack Project Rack=1.5.1
Rack Project Rack=1.4.0
Rack Project Rack=1.4.1
Rack Project Rack=1.4.2
Rack Project Rack=1.4.3
Rack Project Rack=1.4.4
Rack Project Rack=1.3.0
Rack Project Rack=1.3.1
Rack Project Rack=1.3.2
Rack Project Rack=1.3.3
Rack Project Rack=1.3.4
Rack Project Rack=1.3.5
Rack Project Rack=1.3.6
Rack Project Rack=1.3.7
Rack Project Rack=1.3.8
Rack Project Rack=1.3.9
Rack Project Rack=1.2.0
Rack Project Rack=1.2.1
Rack Project Rack=1.2.2
Rack Project Rack=1.2.3
Rack Project Rack=1.2.4
Rack Project Rack=1.2.6
Rack Project Rack=1.2.7
Rack Project Rack=1.1.0
Rack Project Rack=1.1.4
Rack Project Rack=1.1.5
Rack Project Rack=1.1.6

Event History

Feb 8, 2013
CVE Published
12:00 AM
Data Sourced
07:49 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2013-0263?

CVE-2013-0263 is classified as a timing attack vulnerability with the potential for remote code execution.

2

How do I fix CVE-2013-0263?

To mitigate CVE-2013-0263, upgrade to the corrected versions of affected software as listed in the official advisory.

3

Which software versions are affected by CVE-2013-0263?

CVE-2013-0263 affects specific versions of Rack and associated packages including specific versions of candlepin, katello, and others.

4

What types of vulnerabilities are associated with CVE-2013-0263?

CVE-2013-0263 is associated with a timing attack that may expose sensitive information or allow unauthorized access.

5

Is CVE-2013-0263 included in any security patches?

Yes, CVE-2013-0263 is addressed in specific security updates provided by Red Hat as part of their advisory.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203