FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rest-client -- session fixation vulnerability

Affected packages
rubygem-rest-client < 1.6.7_1

Details

VuXML ID 83a7a720-07d8-11e5-9a28-001e67150279
Discovery 2015-03-24
Entry 2015-05-31
Modified 2015-09-28

Andy Brody reports:

When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration.

References

CVE Name CVE-2015-1820
FreeBSD PR ports/200504
URL https://github.com/rest-client/rest-client/issues/369