VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 8, 2013· Updated Apr 29, 2026

CVE-2013-0263

CVE-2013-0263

Description

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rackRubyGems
>= 1.5.0, < 1.5.21.5.2
rackRubyGems
>= 1.4.0, < 1.4.51.4.5
rackRubyGems
>= 1.3.0, < 1.3.101.3.10
rackRubyGems
>= 1.2.0, < 1.2.81.2.8
rackRubyGems
>= 1.1.0, < 1.1.61.1.6

Affected products

28
  • Rack Project/Rack28 versions
    cpe:2.3:a:rack_project:rack:1.1.0:*:*:*:*:*:*:*+ 27 more
    • cpe:2.3:a:rack_project:rack:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rack_project:rack:1.5.1:*:*:*:*:*:*:*

Patches

2
0cd7e9aa397f

Use secure_compare for hmac comparison

https://github.com/rack/rackJames TuckerFeb 7, 2013via ghsa
commit
1 file changed · +1 −1
  • lib/rack/session/cookie.rb+1 −1 modified
    @@ -159,7 +159,7 @@ def destroy_session(env, session_id, options)
       def digest_match?(data, digest)
         return unless data && digest
         @secrets.any? do |secret|
-          digest == generate_hmac(data, secret)
+          Rack::Utils.secure_compare(digest, generate_hmac(data, secret))
         end
       end
9a81b9614578

Add secure_compare to Rack::Utils

https://github.com/rack/rackJames TuckerFeb 6, 2013via ghsa
commit
2 files changed · +17 −0
  • lib/rack/utils.rb+12 −0 modified
    @@ -395,6 +395,18 @@ def byte_ranges(env, size)
     end
     module_function :byte_ranges
 
+    # Constant time string comparison.
+    def secure_compare(a, b)
+      return false unless bytesize(a) == bytesize(b)
+
+      l = a.unpack("C*")
+
+      r, i = 0, -1
+      b.each_byte { |v| r |= v ^ l[i+=1] }
+      r == 0
+    end
+    module_function :secure_compare
+
     # Context allows the use of a compatible middleware at different points
     # in a request handling stack. A compatible middleware must define
     # #context which should take the arguments env and app. The first of which
  • test/spec_utils.rb+5 −0 modified
    @@ -354,6 +354,11 @@ def kcodeu
     Rack::Utils.bytesize("FOO\xE2\x82\xAC").should.equal 6
   end
 
+  should "should perform constant time string comparison" do
+    Rack::Utils.secure_compare('a', 'a').should.equal true
+    Rack::Utils.secure_compare('a', 'b').should.equal false
+  end
+
   should "return status code for integer" do
     Rack::Utils.status_code(200).should.equal 200
   end

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

25

News mentions

0

No linked articles in our index yet.