CVE-2004-0755
Fixed in a distro release EPSS <1%
The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
Products: yukihiro_matsumoto ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 3.0 | ruby | 1.6.7-3woody3 |
| Red Hat Enterprise Linux 3 | irb | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby-debuginfo | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby-devel | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby-docs | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby-libs | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby-mode | 0:1.6.8-9.EL3.2 |
| Red Hat Enterprise Linux 3 | ruby-tcltk | 0:1.6.8-9.EL3.2 |