Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-fg9w-g6m4-557j
Advisory ID github_osv/GHSA-fg9w-g6m4-557j
Aliases CVE-2009-3086
Summary actionpack and activesupport vulnerable to information leaks A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
https://github.com/rails/rails
https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0
https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978
https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3086.yml
https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544
https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600
https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427
http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
http://www.debian.org/security/2011/dsa-2260
CVE-2009-3086 https://nvd.nist.gov/vuln/detail/CVE-2009-3086
CVE-2009-3086.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.