Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 505142 (CVE-2014-2538) - <dev-ruby/rack-ssl-1.4.0: URL error display XSS (CVE-2014-2538)
Summary: <dev-ruby/rack-ssl-1.4.0: URL error display XSS (CVE-2014-2538)
Status: RESOLVED FIXED
Alias: CVE-2014-2538
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: ~4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-20 08:21 UTC by Agostino Sarubbo
Modified: 2014-05-17 16:01 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-03-20 08:21:27 UTC 
From ${URL} :

Marcus Meissner of SuSE reports:

The latest version of rack-ssl rubygem (1.4.0) contains a commit that fixes a
XSS vulnerability in the error page. 

Please note that this requires an adaptor to send a malformed URL to rack-ssl.

External reference:
https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b


@maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Hans de Graaff gentoo-dev Security 2014-03-22 07:24:18 UTC 
rack-ssl 1.4.0 is now in the tree.

Removal of the vulnerable version is not trivial since Rails 3.2 depends specifically on this version. We'll investigate and see if we can fix this.
Comment 2 Hans de Graaff gentoo-dev Security 2014-04-21 09:09:35 UTC 
rack-ssl 1.3.4 has been released with a fix for this issue as well, added to the tree.

Vulnerable version has been removed.
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2014-04-24 05:50:34 UTC 
Maintainer(s), Thank you for cleanup!

No GLSA needed as there are no stable versions.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2014-04-28 19:44:51 UTC 
CVE-2014-2538 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2538):
  Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl
  gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web
  script or HTML via a URI, which might not be properly handled by third-party
  adapters such as JRuby-Rack.