CVE-2024-26144
Fixed in a distro release EPSS 1%CVSS 5.3
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
Products: rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activestorage | 6.1.7.7 |
| RubyGems | activestorage | 7.0.8.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u1 |
| Debian 13 | rails | 2:7.2.2.1+dfsg-1 |
| Debian 14 | rails | 2:7.2.2.1+dfsg-1 |
| Red Hat satellite 6.15 | python-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite 6.15 | python3.11-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite 6.15 | rubygem-activestorage | 0:6.1.7.7-1.el8sat |
| Red Hat satellite 6.15 | rubygem-rack | 0:2.2.8.1-1.el8sat |
| Red Hat satellite capsule 6.15 | python-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite capsule 6.15 | rubygem-rack | 0:2.2.8.1-1.el8sat |
| Ubuntu 24.04 LTS | rails | no fix |
| Ubuntu 25.10 | rails | no fix |
| Ubuntu 26.04 LTS | rails | no fix |
| Ubuntu 26.10 | rails | no fix |
| Ubuntu Pro 16.04 LTS | rails | no fix |
| Ubuntu Pro 18.04 LTS | rails | no fix |
| Ubuntu Pro 20.04 LTS | rails | no fix |
| Ubuntu Pro 22.04 LTS | rails | no fix |