CVE & CISA-KEV CatalogNVD
CVE-2024-26144
MEDIUM5.3
CVSS v3
Description
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
How to fix
Remediation Available
railsDebian
Fixed in:2:6.1.7.10+dfsg-1~deb12u1CVE-2024-26144
Fixed in:2:7.2.2.1+dfsg-1CVE-2024-26144
Fixed in:2:7.2.2.1+dfsg-1CVE-2024-26144
foremanRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foremanRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-cliRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-cliRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-debugRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-debugRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-dynflow-sidekiqRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-dynflow-sidekiqRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-ec2Red Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-ec2Rocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-fapolicydRed Hat / RHEL
Fixed in:0:1.0.1-3.el8satRHSA-2024:10806
Fixed in:0:1.0.1-3.el8satRHSA-2024:10806
foreman-fapolicydRocky
Fixed in:0:1.0.1-3.el8satRHSA-2024:10806
Fixed in:0:1.0.1-3.el8satRHSA-2024:10806
foreman-installerRocky
Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806
Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806
foreman-installerRed Hat / RHEL
Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806
Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806
foreman-installer-katelloRocky
Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806
foreman-installer-katelloRed Hat / RHEL
Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806
foreman-journaldRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-journaldRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-libvirtRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-libvirtRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-openstackRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-openstackRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-ovirtRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-ovirtRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-pcpRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-pcpRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-postgresqlRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-postgresqlRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-proxy-fapolicydRed Hat / RHEL
Fixed in:0:1.0.1-3.el8satRHSA-2024:10806
foreman-proxy-fapolicydRocky
Fixed in:0:1.0.1-3.el8satRHSA-2024:10806
foreman-redisRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-redisRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-serviceRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-serviceRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-telemetryRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-telemetryRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-vmwareRocky
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
foreman-vmwareRed Hat / RHEL
Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806
pulpcore-obsolete-packagesRocky
Fixed in:0:1.0-10.el8pcRHSA-2024:10806
Fixed in:0:1.0-10.el8pcRHSA-2024:10806
pulpcore-obsolete-packagesRed Hat / RHEL
Fixed in:0:1.0-10.el8pcRHSA-2024:10806
Fixed in:0:1.0-10.el8pcRHSA-2024:10806
puppetserverRed Hat / RHEL
Fixed in:0:7.17.2-1.el8satRHSA-2024:10806
Fixed in:0:7.17.2-1.el8satRHSA-2024:10806
puppetserverRocky
Fixed in:0:7.17.2-1.el8satRHSA-2024:10806
Fixed in:0:7.17.2-1.el8satRHSA-2024:10806
python-pulp-containerRed Hat / RHEL
Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806
python-pulp-containerRocky
Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806
python3.11-pulp-containerRocky
Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806
python3.11-pulp-containerRed Hat / RHEL
Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806
rubygem-actioncableRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actioncableRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionmailboxRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionmailboxRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionmailerRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionmailerRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionpackRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionpackRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actiontextRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actiontextRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionviewRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-actionviewRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activejobRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activejobRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activemodelRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activemodelRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activerecordRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activerecordRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activestorageRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activestorageRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activesupportRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-activesupportRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-foreman_rh_cloudRed Hat / RHEL
Fixed in:0:9.0.59-1.el8satRHSA-2024:10806
Fixed in:0:9.0.59-1.el8satRHSA-2024:10806
rubygem-foreman_rh_cloudRocky
Fixed in:0:9.0.59-1.el8satRHSA-2024:10806
Fixed in:0:9.0.59-1.el8satRHSA-2024:10806
rubygem-katelloRed Hat / RHEL
Fixed in:0:4.11.0.19-1.el8satRHSA-2024:10806
Fixed in:0:4.11.0.19-1.el8satRHSA-2024:10806
rubygem-katelloRocky
Fixed in:0:4.11.0.19-1.el8satRHSA-2024:10806
Fixed in:0:4.11.0.19-1.el8satRHSA-2024:10806
rubygem-rackRed Hat / RHEL
Fixed in:0:2.2.8.1-1.el8satRHSA-2024:10806
Fixed in:0:2.2.8.1-1.el8satRHSA-2024:10806
rubygem-rackRocky
Fixed in:0:2.2.8.1-1.el8satRHSA-2024:10806
Fixed in:0:2.2.8.1-1.el8satRHSA-2024:10806
rubygem-railsRocky
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-railsRed Hat / RHEL
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806
rubygem-railtiesRed Hat / RHEL
Fixed in:0:6.1.7.7-2.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-2.el8satRHSA-2024:10806
rubygem-railtiesRocky
Fixed in:0:6.1.7.7-2.el8satRHSA-2024:10806
Fixed in:0:6.1.7.7-2.el8satRHSA-2024:10806
rubygem-smart_proxy_ansibleRed Hat / RHEL
Fixed in:0:3.5.6-0.1.el8satRHSA-2024:10806
Fixed in:0:3.5.6-0.1.el8satRHSA-2024:10806
rubygem-smart_proxy_ansibleRocky
Fixed in:0:3.5.6-0.1.el8satRHSA-2024:10806
Fixed in:0:3.5.6-0.1.el8satRHSA-2024:10806
satelliteRocky
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satelliteRed Hat / RHEL
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satellite-capsuleRocky
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satellite-capsuleRed Hat / RHEL
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satellite-cliRed Hat / RHEL
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satellite-cliRocky
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satellite-commonRed Hat / RHEL
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
satellite-commonRocky
Fixed in:0:6.15.5-1.el8satRHSA-2024:10806
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploit Intelligence
1.12%probability of exploitation in 30 days
62ndpercentile
Moderate risk: more likely to be exploited than 62% of all known CVEs.
References
Patch2
Vendor Advisory2
Third-Party Advisory2
Related Vulnerabilities
Other CWE-200 (Information Exposure) vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2024-24919 | High | 8.6 | 100% | KEV + Ransom | - |
| CVE-2020-14181 | Medium | 5.3 | 100% | - | Fix |
| CVE-2021-34429 | Medium | 5.3 | 99% | - | Fix |
| CVE-2018-11409 | Medium | 5.3 | 98% | - | - |
| CVE-2021-41277 | Critical | 10.0 | 97% | KEV | - |
| CVE-2016-2183 | High | 7.5 | 96% | - | Fix |
Embed a live status badge for CVE-2024-26144
Markdown
[](https://tridentstack.com/cve/CVE-2024-26144)HTML
<a href="https://tridentstack.com/cve/CVE-2024-26144"><img src="https://tridentstack.com/cve/badge/CVE-2024-26144.svg" alt="CVE-2024-26144"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-02-14.