Vulnerability Description
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Excon Project | Excon | < 0.71.0 |
| Opensuse | Backports Sle | 15.0 |
| Opensuse | Leap | 15.1 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.htmlThird Party Advisory
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29PatchThird Party Advisory
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00015.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.htmlThird Party Advisory
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29PatchThird Party Advisory
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00015.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2019-16779?
CVE-2019-16779 is a vulnerability with a CVSS score of 5.8 (MEDIUM). In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requ...
How severe is CVE-2019-16779?
CVE-2019-16779 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-16779?
Check the references section above for vendor advisories and patch information. Affected products include: Excon Project Excon, Opensuse Backports Sle, Opensuse Leap, Debian Debian Linux.