CVE-2020-8161: 
Ruby vulnerability analysis and mitigation

A directory traversal vulnerability (CVE-2020-8161) was discovered in Rack versions prior to 2.2.0. The vulnerability exists in the Rack::Directory app bundled with Rack, which was disclosed on May 13, 2020. The issue affects applications using Rack::Directory component, while applications not using this component remain unaffected (Rails Security).

The vulnerability stems from incorrect handling of certain paths in the Rack::Directory component. When specific directories exist in a directory managed by Rack::Directory, the flaw allows attackers to perform directory traversal outside of the root specified in the Rack::Directory initializer. The vulnerability has been assigned a CVSS 3 Severity Score of 8.6 (High) (Ubuntu CVE).

If exploited, this vulnerability could allow an attacker to read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer, potentially leading to unauthorized information disclosure (Rails Security).

The vulnerability requires network access but no authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit in environments where Rack::Directory is in use (Ubuntu CVE).

The vulnerability has been fixed in Rack versions 2.1.3 and 2.2.0 or later. For developers unable to immediately upgrade, the recommended workaround is to avoid using Rack::Directory in their applications. Various Linux distributions have also released security updates to address this vulnerability, including Ubuntu (1.6.4-4ubuntu0.2 for 18.04 LTS) and Debian (Rails Security, Ubuntu Notice).