CVE:CVE-2019-16782
CNNVD:CNNVD-201912-865
RubyGem Rack是一款使用Ruby编程语言开发的Web服务器和Web应用程序之间的模块化接口。
RubyGem Rack 中存在安全漏洞。攻击者可通过对会话ID进行时序攻击利用该漏洞劫持会话。
solution:Upgrade rack_project rack to a higher version than 1.6.12,2.0.8,and avoid the version (,1.6.12),[2.0.0,2.0.8); Upgrade fedoraproject fedora to a higher version than 31,and avoid the version 31; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1