{"action":"Upgrade rack to 1.1.6 or later.","affected":[{"fixed":"1.5.2","introduced":"1.5.0"},{"fixed":"1.4.5","introduced":"1.4.0"},{"fixed":"1.3.10","introduced":"1.3.0"},{"fixed":"1.2.8","introduced":"1.2.0"},{"fixed":"1.1.6","introduced":"1.1.0"}],"component":"rack","cve_ids":["CVE-2013-0263"],"ecosystem":"RubyGems","epss":0.05383,"exploited":false,"fixed_versions":["1.5.2","1.4.5","1.3.10","1.2.8","1.1.6"],"ghsa_id":"GHSA-xc85-32mf-xpv8","id":"tcs_01M5KEP7HTG08HAS99NJWBYCCX","modified_at":"2024-12-05T05:42:22.738151Z","published_at":"2022-05-05T02:48:42Z","references":["https://osv.dev/vulnerability/GHSA-xc85-32mf-xpv8","https://nvd.nist.gov/vuln/detail/CVE-2013-0263","https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07","https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11","https://bugzilla.redhat.com/show_bug.cgi?id=909071","https://gist.github.com/codahale/f9f3781f7b54985bee94","https://github.com/rack/rack","https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J","https://groups.google.com/forum/#!msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ","https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ","https://groups.google.com/forum/#!msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ","https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ","http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html","http://rhn.redhat.com/errata/RHSA-2013-0686.html","http://www.debian.org/security/2013/dsa-2783"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xc85-32mf-xpv8","url":"https://osv.dev/vulnerability/GHSA-xc85-32mf-xpv8"}],"summary":"Rack arbitrary code execution via timing attack"}