CVE-2019-16779: fallo de gravedad media en excon
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.8epss 1.7%
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Productos afectados
excon · exconCVEs relacionadas — excon
En el mismo producto, de las más peligrosas a las menos.
Referencias
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.htmlhttps://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html