Lucene search

PRIOn knowledge basePRION:CVE-2019-16779

HistoryDec 16, 2019 - 8:15 p.m.

Race condition

2019-12-1620:15:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.5%

JSON

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

CPENameOperatorVersion
debian_linuxeq8.0
exconlt0.71.0
backports_sleeq15.0 sp1
leapeq15.1

Name	Operator	Version
debian_linux	eq	8.0
excon	lt	0.71.0
backports_sle	eq	15.0 sp1
leap	eq	15.1

References

lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html

lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html

github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29

github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9

lists.debian.org/debian-lts-announce/2020/01/msg00015.html