ruby-rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. Prior to version 2.2.14, whenusing the `Rack::Session::Pool` middleware, simultaneous rack requests canrestore a deleted rack session, which allows the unauthenticated user tooccupy that session. Rack session middleware prepares the session at thebeginning of request, then saves is back to the store with possible changesapplied by host rack application. This way the session becomes to be asubject of race conditions in general sense over concurrent rack requests.When using the `Rack::Session::Pool` middleware, and provided the attackercan acquire a session cookie (already a major issue), the session may berestored if the attacker can trigger a long running request (within thatsame session) adjacent to the user logging out, in order to retain illicitaccess even after a user has attempted to logout. Version 2.2.14 contains apatch for the issue. Some other mitigations are available. Either ensurethe application invalidates sessions atomically by marking them as loggedout e.g., using a `logged_out` flag, instead of deleting them, and checkthis flag on every request to prevent reuse; or implement a custom sessionstore that tracks session invalidation timestamps and refuses to acceptsession data if the session was invalidated after the request began.

Where it's fixed