p PatchFirst

CVE-2007-6077

CVE-2007-6077

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

EPSS 2.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • rails Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.2.6-1

    Update to 1.2.6-1

  • rails Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.2.6-1

    Update to 1.2.6-1

  • rails Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.2.6-1

    Update to 1.2.6-1

Original sources

Check your server →