CVE-2018-16471

RubyGems/rack CVE-2018-16471: medium 6.1, EPSS 1.89%

Rack vulnerable to Cross-site Scripting

Action: Upgrade rack to 1.6.11 or later.

bundle update rack

Affected

Fixed versions

Sources

• osv: GHSA-5r2p-j47h-mhpg
• https://nvd.nist.gov/vuln/detail/CVE-2018-16471
• https://github.com/rack/rack
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16471.yml
• https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
• https://groups.google.com/forum/#!topic/rubyonrails-security/GKsAFT924Ag
• https://lists.debian.org/debian-lts-announce/2018/11/msg00022.html
• https://usn.ubuntu.com/4089-1
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00032.html
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html

CVE-2018-16471 · published 2018-11-15T15:59:08Z · modified 2024-02-18T05:22:09.088480Z · JSON