CVE catalog

CVE-2024-43791

ruby-request-store: CVE-2024-43791

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-request-storesid1.5.1-1not affected
Debianruby-request-storeforky1.5.1-1not affected
Debianruby-request-storetrixie1.5.1-1not affected
Debianruby-request-storebookworm1.5.1-1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-request-storesourcesidNot affectedunimportantNot reportedNot reported
Debianruby-request-storesourceforkyNot affectedunimportantNot reportedNot reported
Debianruby-request-storesourcetrixieNot affectedunimportantNot reportedNot reported
Debianruby-request-storesourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-request-store]Not affected
    Details (2)

    • 1.5.1-1 · all · bookworm

      Not affected

      dsa · ruby-request-store · debian · bookworm

    • 1.5.1-1 · all · bookworm

      Not affected

      dsa · ruby-request-store · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]