CVE-2019-16779

MEDIUM5.8

In RubyGem excon, interrupted Persistent Connections May Leak Response Data

Published Dec 16, 2019

Modified 1 years ago

Details

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

References

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html

WEB

https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29

WEB

https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9

WEB

https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html

ADVISORY