CVE-2019-16779: In RubyGem excon, interrupted Persistent Connections May Leak Response Data
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16779?
CVE-2019-16779 has a medium severity due to the potential for unintended data leakage from race conditions.
How do I fix CVE-2019-16779?
To fix CVE-2019-16779, update Excon to version 0.71.0 or later.
Which versions of Excon are affected by CVE-2019-16779?
Excon versions prior to 0.71.0 are affected by CVE-2019-16779.
What platforms are impacted by CVE-2019-16779?
CVE-2019-16779 impacts multiple platforms including Debian 8.0, openSUSE Leap 15.1, and openSUSE Backports SLE 15.0 SP1.
What are the implications of not addressing CVE-2019-16779?
Failing to address CVE-2019-16779 could result in sensitive information being unintentionally exposed through incorrect socket data.