The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Ruby | — | Apply OS X security update 2007-009 | Dec 16, 2011 | Nov 21, 2007 |
| Debian | — | Upgrade rails | Jul 30, 2024 | Nov 21, 2007 |
| Freebsd | — | Upgrade rubygem-rails | Dec 10, 2025 | Nov 27, 2007 |
| Gentoo Linux | — | Upgrade dev-ruby/rails. | Oct 30, 2017 | Nov 21, 2007 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Nov 21, 2007 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub