csaf_opensuse - opensuse-su-2020:0139-1

OPENSUSE-SU-2020:0139-1

Vulnerability from csaf_opensuse - Published: 2020-01-29 16:41 - Updated: 2020-01-29 16:41

Summary

Security update for rubygem-excon

Notes

Title of the patch

Security update for rubygem-excon

Description of the patch

This update for rubygem-excon fixes the following issues: CVE-2019-16779 (boo#1159342): Fix a race condition around persistent connections, where a connection, which was interrupted, would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. This update was imported from the openSUSE:Leap:15.1:Update update project.

Patchnames

openSUSE-2020-139

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for rubygem-excon",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for rubygem-excon fixes the following issues:\n\nCVE-2019-16779 (boo#1159342):\nFix a race condition around persistent connections, where a connection,\nwhich was interrupted, would leave data on the socket.\nSubsequent requests would then read this data, returning content from the previous response.\n\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-139",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0139-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:0139-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/24HLW5E7VDSXDL6W4QB2LMVOF74HLGW7/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:0139-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/24HLW5E7VDSXDL6W4QB2LMVOF74HLGW7/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1159342",
        "url": "https://bugzilla.suse.com/1159342"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16779 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16779/"
      }
    ],
    "title": "Security update for rubygem-excon",
    "tracking": {
      "current_release_date": "2020-01-29T16:41:25Z",
      "generator": {
        "date": "2020-01-29T16:41:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:0139-1",
      "initial_release_date": "2020-01-29T16:41:25Z",
      "revision_history": [
        {
          "date": "2020-01-29T16:41:25Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64",
                "product": {
                  "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64",
                  "product_id": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64",
                "product": {
                  "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64",
                  "product_id": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64",
                "product": {
                  "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64",
                  "product_id": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le",
                "product": {
                  "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le",
                  "product_id": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le",
                "product": {
                  "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le",
                  "product_id": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le",
                "product": {
                  "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le",
                  "product_id": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x",
                "product": {
                  "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x",
                  "product_id": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x",
                "product": {
                  "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x",
                  "product_id": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x",
                "product": {
                  "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x",
                  "product_id": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64",
                "product": {
                  "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64",
                  "product_id": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64",
                "product": {
                  "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64",
                  "product_id": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64",
                "product": {
                  "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64",
                  "product_id": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP1",
                "product": {
                  "name": "SUSE Package Hub 15 SP1",
                  "product_id": "SUSE Package Hub 15 SP1"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64"
        },
        "product_reference": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le"
        },
        "product_reference": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x"
        },
        "product_reference": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64"
        },
        "product_reference": "ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64"
        },
        "product_reference": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le"
        },
        "product_reference": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x"
        },
        "product_reference": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64"
        },
        "product_reference": "ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64"
        },
        "product_reference": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le"
        },
        "product_reference": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x"
        },
        "product_reference": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64"
        },
        "product_reference": "ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-16779",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16779"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x",
          "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16779",
          "url": "https://www.suse.com/security/cve/CVE-2019-16779"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159342 for CVE-2019-16779",
          "url": "https://bugzilla.suse.com/1159342"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.aarch64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.s390x",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1.x86_64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.aarch64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.s390x",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1.x86_64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.aarch64",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.s390x",
            "SUSE Package Hub 15 SP1:ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-29T16:41:25Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-16779"
    }
  ]
}

CVE-2019-16779 (GCVE-0-2019-16779)

Vulnerability from cvelistv5 – Published: 2019-12-16 19:35 – Updated: 2024-08-05 01:24

Summary

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

CWE

CWE-664 - Improper Control of a Resource Through its Lifetime

Assigner

GitHub_M

References

URL

Tags

	https://github.com/excon/excon/security/advisorie…	x_refsource_CONFIRM
	https://github.com/excon/excon/commit/ccb57d7a422…	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE

Impacted products

	Vendor	Product	Version
	excon	excon	Affected: < 0.71.0 , < 0.71.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.572Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29"
          },
          {
            "name": "openSUSE-SU-2020:0036",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html"
          },
          {
            "name": "[debian-lts-announce] 20200119 [SECURITY] [DLA 2070-1] ruby-excon security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html"
          },
          {
            "name": "openSUSE-SU-2020:0139",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "excon",
          "vendor": "excon",
          "versions": [
            {
              "lessThan": "0.71.0",
              "status": "affected",
              "version": "\u003c 0.71.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-664",
              "description": "CWE-664 Improper Control of a Resource Through its Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-29T21:06:17",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29"
        },
        {
          "name": "openSUSE-SU-2020:0036",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html"
        },
        {
          "name": "[debian-lts-announce] 20200119 [SECURITY] [DLA 2070-1] ruby-excon security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html"
        },
        {
          "name": "openSUSE-SU-2020:0139",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html"
        }
      ],
      "source": {
        "advisory": "GHSA-q58g-455p-8vw9",
        "discovery": "UNKNOWN"
      },
      "title": "In RubyGem excon, interrupted Persistent Connections May Leak Response Data",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users can workaround the problem by disabling persistent connections, though this may cause performance implications."
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2019-16779",
          "STATE": "PUBLIC",
          "TITLE": "In RubyGem excon, interrupted Persistent Connections May Leak Response Data"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "excon",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "\u003c 0.71.0",
                            "version_value": "0.71.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "excon"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-664 Improper Control of a Resource Through its Lifetime"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9",
              "refsource": "CONFIRM",
              "url": "https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9"
            },
            {
              "name": "https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29",
              "refsource": "MISC",
              "url": "https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29"
            },
            {
              "name": "openSUSE-SU-2020:0036",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html"
            },
            {
              "name": "[debian-lts-announce] 20200119 [SECURITY] [DLA 2070-1] ruby-excon security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html"
            },
            {
              "name": "openSUSE-SU-2020:0139",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-q58g-455p-8vw9",
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Users can workaround the problem by disabling persistent connections, though this may cause performance implications."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2019-16779",
    "datePublished": "2019-12-16T19:35:13",
    "dateReserved": "2019-09-24T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2020:0139-1

CVE-2019-16779 (GCVE-0-2019-16779)

Tags

Sightings

Nomenclature