CVE-2009-3086 actionpack and activesupport vulnerable to information leaks

Medium 5.0 Published 8 Sep 2009 Updated 7 Aug 2024

Remote attackers can exploit a timing side-channel in cookie signature verification to forge valid digests, potentially bypassing authentication or integrity checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-3086?

CVE-2009-3086 is a medium-severity vulnerability in Rubyonrails Rails, published on 8 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

Weakness: CWE-200

Which versions are affected by CVE-2009-3086?

8 open source packages ship an affected version, including actionpack and activesupport. It affects 1 product.

Package	Affected	Fixed in
`actionpack` RubyGems	From `2.1.0`	`2.2.3`
`actionpack` RubyGems	From `2.1.0`	`2.2.3`
`actionpack` RubyGems	From `2.3.0`	`2.3.4`
`actionpack` RubyGems	From `2.3.0`	`2.3.4`
`activesupport` RubyGems	From `2.1.0`	`2.2.3`
`activesupport` RubyGems	From `2.1.0`	`2.2.3`

2 more packages

`activesupport` RubyGems	From `2.3.0`	`2.3.4`
`activesupport` RubyGems	From `2.3.0`	`2.3.4`

Products include Rubyonrails Rails.

How do I fix CVE-2009-3086?

Upgrade actionpack to a fixed version for your release line: 2.2.3 or 2.3.4.

Is CVE-2009-3086 being exploited?

There is no known exploitation of CVE-2009-3086 in the wild and no public exploit code.

All Rubyonrails Rails vulnerabilities

Sources

Also known as DEBIAN-CVE-2009-3086, GHSA-fg9w-g6m4-557j.