TI-2020-06602 Aliases CVE-2020-8184 GHSA-j6w9-fv6q-3q52

Improper input validation in https://github.com/rack/rack

LOW 38CWE-784Published 2020-06-19 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Why it matters now

EPSS 0.03011 87th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial rack (RubyGems): 2.1.4, 2.2.3Red Hat: 1 advisoryRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	https://github.com/rack/rack	rack >= 2.2.3, rack >= 2.1.4	—	No fix listed	CNA
—	rack (RubyGems)	before 2.1.4	2.1.4	Patch available	GHSA-j6w9-fv6q-3q52
—	rack (RubyGems)	2.2.0 to before 2.2.3	2.2.3	Patch available	GHSA-j6w9-fv6q-3q52

https://github.com/rack/rack Vendor— Affected rack >= 2.2.3, rack >= 2.1.4 Fixed in — No fix listed CNA
rack (RubyGems) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-j6w9-fv6q-3q52
rack (RubyGems) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-j6w9-fv6q-3q52

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:rack_project:rack::::::::	before 2.1.4; 2.2.0 to before 2.2.3	Vulnerable	Rack Project
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::	18.04	Vulnerable	Canonical

cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:* Versions before 2.1.4; 2.2.0 to before 2.2.3 Vulnerable ·Rack Project
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical

Remediation

Fix · GHSA-j6w9-fv6q-3q52 rack (RubyGems) Fixed in 2.1.4 Advisory →
Fix · GHSA-j6w9-fv6q-3q52 rack (RubyGems) Fixed in 2.2.3 Advisory →

Red Hat 1 advisory

RHSA-2020:4366 Released 2020-10-27 · Red Hat rating Important
Satellite 6.8 release
- Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
- Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
CloudForms Management Engine 5	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton) Operational Tools	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens) Operational Tools	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet
Red Hat Satellite 6.8	Fixed	RHSA-2020:4366
Red Hat Satellite Capsule 6.8	Fixed	RHSA-2020:4366

Not affected: 2 products

Red Hat Enterprise Linux 9
Red Hat Storage 3

Timeline

2026-10-02 Threatist record created from CVE-2020-8184
2026-10-03 Alias added: GHSA-j6w9-fv6q-3q52

References

Exploit 1

https://hackerone.com/reports/895727

Patch 1

https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak

Advisory 4

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences