CVE-2026-39324
github.com/rack/rack-session: Rack::Session: Unauthorized access via crafted session cookies
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Red Hat. Más baja según Ubuntu (media).
Descripción
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is fixed in 2.1.2.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rack-session | 2.1.2 |
| chainguard | logstash-8.19, logstash-9.0, logstash-9.1 y 16 más | 8.19.14-r3 y 15 más |
| debian 13 | ruby-rack-session | 2.1.1-0.1+deb13u1 |
| debian 14 | ruby-rack-session | 2.1.1-0.2 |
| echo | ruby-rack-session | 2.1.1-0.1+deb13u1 |
| minimos | logstash-9.3, ruby3.4-rack-session, ruby4.0-rack-session | 9.3.4-r0 y 1 más |
| rapidfort debian 12 | ruby-rack-session | 0:2.1.1-0.1+deb13u1, 0:2.1.1-0.2 |
| rapidfort debian 13 | ruby-rack-session | 0:2.1.1-0.1+deb13u1, 0:2.1.1-0.2 |
| rapidfort ubuntu 20.04 | ruby-rack-session | 0:2.1.1-0.1ubuntu0.1 |
| rapidfort ubuntu 22.04 | ruby-rack-session | 0:2.1.1-0.1ubuntu0.1 |
| rapidfort ubuntu 24.04 | ruby-rack-session | 0:2.1.1-0.1ubuntu0.1 |
| rubygems::Ruby Advisory Database | rack-session | >= 2.1.2 |
Mostrar las 39 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rack-session | 2.1.2 |
| chainguard | logstash-8.19 | 8.19.14-r3 |
| chainguard | logstash-9.0 | 9.0.8-r20 |
| chainguard | logstash-9.1 | 9.1.10-r6 |
| chainguard | logstash-9.2 | 9.2.8-r2 |
| chainguard | logstash-9.3 | 9.3.3-r2 |
| chainguard | pact-broker-docker | 2.137.0.2.118.0-r4 |
| chainguard | pact-broker-docker-fips | 2.137.0.2.118.0-r2 |
| chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r2 |
| chainguard | ruby3.2-rails-8.0 | 8.0.5-r0 |
| chainguard | ruby3.2-rails-8.1 | 8.1.3-r3 |
| chainguard | ruby3.3-rails-7.2 | 7.2.3.1-r4 |
| chainguard | ruby3.3-rails-8.0 | 8.0.5-r3 |
| chainguard | ruby3.3-rails-8.1 | 8.1.3-r4 |
| chainguard | ruby3.4-rails-7.2 | 7.2.3.1-r2 |
| chainguard | ruby3.4-rails-8.0 | 8.0.5-r2 |
| chainguard | ruby3.4-rails-8.1 | 8.1.3-r4 |
| chainguard | ruby4.0-rails-7.2 | 7.2.3.1-r3 |
| chainguard | ruby4.0-rails-8.0 | 8.0.5-r1 |
| chainguard | ruby4.0-rails-8.1 | 8.1.3-r3 |
| debian 13 | ruby-rack-session | 2.1.1-0.1+deb13u1 |
| debian 14 | ruby-rack-session | 2.1.1-0.2 |
| echo | ruby-rack-session | 2.1.1-0.1+deb13u1 |
| minimos | logstash-9.3 | 9.3.4-r0 |
| minimos | ruby3.4-rack-session | 2.1.2-r0 |
| minimos | ruby4.0-rack-session | 2.1.2-r0 |
| rapidfort debian 12 | ruby-rack-session | 0:2.1.1-0.1+deb13u1, 0:2.1.1-0.2 |
| rapidfort debian 13 | ruby-rack-session | 0:2.1.1-0.1+deb13u1, 0:2.1.1-0.2 |
| rapidfort ubuntu 20.04 | ruby-rack-session | 0:2.1.1-0.1ubuntu0.1 |
| rapidfort ubuntu 22.04 | ruby-rack-session | 0:2.1.1-0.1ubuntu0.1 |
| rapidfort ubuntu 24.04 | ruby-rack-session | 0:2.1.1-0.1ubuntu0.1 |
| rubygems::Ruby Advisory Database | rack-session | >= 2.1.2 |
| ubuntu 25.10 | ruby-rack-session | 2.1.1-0.1ubuntu0.1 |
| ubuntu 26.04 | ruby-rack-session | 2.1.1-0.1ubuntu0.26.04.1 |
| wolfi | logstash-9.3 | 9.3.3-r2 |
| wolfi | ruby3.2-rails-8.1 | 8.1.3-r3 |
| wolfi | ruby3.3-rails-8.1 | 8.1.3-r4 |
| wolfi | ruby3.4-rails-8.1 | 8.1.3-r4 |
| wolfi | ruby4.0-rails-8.1 | 8.1.3-r3 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-39324
- https://github.com/advisories/GHSA-33qg-7wpp-89cq
- https://github.com/rack/rack-session
- https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-session/CVE-2026-39324.yml
- https://nvd.nist.gov/vuln/detail/CVE-2026-39324
- https://ubuntu.com/security/notices/USN-8190-1
- https://ubuntu.com/security/notices/USN-8190-2