CoreCVE
Back

CRITICAL

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses

Published Aug 9, 2017

Description

REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

Affected products

Remediation

Red Hat statement

With the release of Satellite 6.9 available, this bug is being closed as wontfix as all parts of our Ruby stack are running under the SCL now with rest-client.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (2)

CWE-201

CWE-384

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 9, 2017
Updated Aug 6, 2024
Reserved Feb 17, 2015
Link CVE-2015-1820
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2015-1820
Red Hat
Severity Moderate
Public date Mar 24, 2015
Links CVE-2015-1820 - Bugzilla
GHSA-3FHF-6939-QG8P