CVE-2013-0263

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-02-08 · updated 2026-06-16

Description

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

Affected products

Rack Project Rack: 1.5.0, 1.5.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3 (+22)

References

http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
http://rack.github.com/
http://rhn.redhat.com/errata/RHSA-2013-0686.html
http://secunia.com/advisories/52033
http://secunia.com/advisories/52134
http://secunia.com/advisories/52774
http://www.debian.org/security/2013/dsa-2783
http://www.osvdb.org/89939
https://bugzilla.redhat.com/show_bug.cgi?id=909071
https://gist.github.com/codahale/f9f3781f7b54985bee94
https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07
https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11

Get alerted when CVE-2013-0263 or the next vulnerability affects your stack