CVE-2019-16779
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket.
Does this matter?
Lower severity and a low EPSS score (1.44%). Track it; it rarely justifies an emergency change on its own.
Description
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.44% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-664, CWE-362
- Affected
- excon project/excon · opensuse/backports sle · opensuse/leap · debian/debian linux
- Source
- security-advisories@github.com
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.htmlThird Party Advisory
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29Patch
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.htmlThird Party Advisory
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29Patch
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00015.htmlMailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.