CVE-2019-16782: Possible Information Leak / Session Hijack Vulnerability in Rack
Published Dec 18, 2019
·Updated
A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality.
Other sources
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
Affected Software
446 affected componentsFixes available
redhat/ansible-runner<0:1.4.6-1.el8a
0:1.4.6-1.el8a
redhat/cfme<0:5.11.6.0-1.el8cf
0:5.11.6.0-1.el8cf
redhat/cfme-amazon-smartstate<0:5.11.6.0-1.el8cf
0:5.11.6.0-1.el8cf
redhat/cfme-appliance<0:5.11.6.0-1.el8cf
0:5.11.6.0-1.el8cf
redhat/cfme-gemset<0:5.11.6.0-1.el8cf
0:5.11.6.0-1.el8cf
redhat/libssh2<0:1.9.0-2.el8cf
0:1.9.0-2.el8cf
redhat/ansible-collection-redhat-satellite<0:1.3.0-1.el7
0:1.3.0-1.el7
redhat/ansiblerole-insights-client<0:1.7.1-1.el7
0:1.7.1-1.el7
redhat/ansiblerole-satellite-receptor-installer<0:0.6.13-1.el7
0:0.6.13-1.el7
redhat/ansible-runner<0:1.4.6-1.el7a
0:1.4.6-1.el7a
redhat/candlepin<0:3.1.21-1.el7
0:3.1.21-1.el7
redhat/foreman<0:2.1.2.19-1.el7
0:2.1.2.19-1.el7
redhat/foreman-bootloaders-redhat<0:202005201200-1.el7
0:202005201200-1.el7
redhat/foreman-discovery-image-service<0:1.0.0-3.el7
0:1.0.0-3.el7
redhat/foreman-installer<1:2.1.2.8-1.el7
1:2.1.2.8-1.el7
redhat/foreman-proxy<0:2.1.2-2.el7
0:2.1.2-2.el7
redhat/foreman-selinux<0:2.1.2.3-1.el7
0:2.1.2.3-1.el7
redhat/future<0:0.16.0-11.el7
0:0.16.0-11.el7
redhat/gofer<0:2.12.5-7.el7
0:2.12.5-7.el7
redhat/hfsplus-tools<0:332.14-12.el7
0:332.14-12.el7
redhat/katello<0:3.16.0-1.el7
0:3.16.0-1.el7
redhat/katello-certs-tools<0:2.7.1-1.el7
0:2.7.1-1.el7
redhat/katello-client-bootstrap<0:1.7.5-1.el7
0:1.7.5-1.el7
redhat/katello-selinux<0:3.4.0-1.el7
0:3.4.0-1.el7
redhat/keycloak-httpd-client-install<0:1.2.2-1.el7
0:1.2.2-1.el7
redhat/kobo<0:0.5.1-1.el7
0:0.5.1-1.el7
redhat/libmodulemd<0:1.7.0-1.pulp.el7
0:1.7.0-1.pulp.el7
redhat/libsolv<0:0.7.4-4.pulp.el7
0:0.7.4-4.pulp.el7
redhat/libwebsockets<0:2.4.2-2.el7
0:2.4.2-2.el7
redhat/livecd-tools<1:20.4-1.6.el7
1:20.4-1.6.el7
redhat/ostree<0:2017.1-2.atomic.el7
0:2017.1-2.atomic.el7
redhat/pcp-mmvstatsd<0:0.4-2.el7
0:0.4-2.el7
redhat/pulp<0:2.21.3-1.el7
0:2.21.3-1.el7
redhat/pulp-docker<0:3.2.7-1.el7
0:3.2.7-1.el7
redhat/pulp-katello<0:1.0.3-1.el7
0:1.0.3-1.el7
redhat/pulp-ostree<0:1.3.1-2.el7
0:1.3.1-2.el7
redhat/pulp-puppet<0:2.21.3-2.el7
0:2.21.3-2.el7
redhat/pulp-rpm<0:2.21.3-2.el7
0:2.21.3-2.el7
redhat/puppet-agent<0:6.14.0-2.el7
0:6.14.0-2.el7
redhat/puppet-agent-oauth<0:0.5.1-3.el7
0:0.5.1-3.el7
redhat/puppetlabs-stdlib<0:4.25.1-2.el7
0:4.25.1-2.el7
redhat/puppetserver<0:6.13.0-1.el7
0:6.13.0-1.el7
redhat/pycairo<0:1.16.3-9.el7
0:1.16.3-9.el7
redhat/pygobject3<0:3.28.3-2.el7
0:3.28.3-2.el7
redhat/python-aiohttp<0:3.6.2-4.el7a
0:3.6.2-4.el7a
redhat/python-amqp<0:2.2.2-5.el7
0:2.2.2-5.el7
redhat/python-anyjson<0:0.3.3-11.el7
0:0.3.3-11.el7
redhat/python-apypie<0:0.2.2-1.el7
0:0.2.2-1.el7
redhat/python-async-timeout<0:3.0.1-2.el7a
0:3.0.1-2.el7a
redhat/python-attrs<0:19.3.0-3.el7a
0:19.3.0-3.el7a
redhat/python-billiard<1:3.5.0.3-3.el7
1:3.5.0.3-3.el7
redhat/python-blinker<0:1.3-2.el7
0:1.3-2.el7
redhat/python-celery<0:4.0.2-9.el7
0:4.0.2-9.el7
redhat/python-chardet<0:3.0.4-10.el7a
0:3.0.4-10.el7a
redhat/python-click<0:6.7-9.el7
0:6.7-9.el7
redhat/python-crane<0:3.3.1-9.el7
0:3.3.1-9.el7
redhat/python-daemon<0:2.1.2-7.el7a
0:2.1.2-7.el7a
redhat/python-dateutil<0:2.8.1-2.el7a
0:2.8.1-2.el7a
redhat/python-django<0:1.11.29-1.el7
0:1.11.29-1.el7
redhat/python-flask<1:0.12.2-4.el7
1:0.12.2-4.el7
redhat/python-gnupg<0:0.3.7-1.el7
0:0.3.7-1.el7
redhat/python-idna<0:2.4-2.el7a
0:2.4-2.el7a
redhat/python-idna-ssl<0:1.1.0-2.el7a
0:1.1.0-2.el7a
redhat/python-isodate<0:0.5.4-12.el7
0:0.5.4-12.el7
redhat/python-itsdangerous<0:0.24-15.el7
0:0.24-15.el7
redhat/python-jinja2<0:2.10-10.el7
0:2.10-10.el7
redhat/python-jmespath<0:0.9.0-6.el7_7
0:0.9.0-6.el7_7
redhat/python-kid<0:0.9.6-11.el7
0:0.9.6-11.el7
redhat/python-kombu<10:4.0.2-13.el7
10:4.0.2-13.el7
redhat/python-lockfile<1:0.11.0-10.el7a
1:0.11.0-10.el7a
redhat/python-markupsafe<0:0.23-21.el7
0:0.23-21.el7
redhat/python-mongoengine<0:0.10.5-2.el7
0:0.10.5-2.el7
redhat/python-multidict<0:4.7.4-2.el7a
0:4.7.4-2.el7a
redhat/python-nectar<0:1.6.2-1.el7
0:1.6.2-1.el7
redhat/python-oauth2<0:1.5.211-8.el7
0:1.5.211-8.el7
redhat/python-okaara<0:1.0.37-2.el7
0:1.0.37-2.el7
redhat/python-pexpect<0:4.6-1.el7a
0:4.6-1.el7a
redhat/python-prometheus-client<0:0.7.1-2.el7a
0:0.7.1-2.el7a
redhat/python-psutil<0:5.0.1-3.el7
0:5.0.1-3.el7
redhat/python-ptyprocess<0:0.5.2-3.el7a
0:0.5.2-3.el7a
redhat/python-pycurl<0:7.43.0.2-4.el7
0:7.43.0.2-4.el7
redhat/python-pymongo<0:3.2-2.el7
0:3.2-2.el7
redhat/python-qpid<0:1.35.0-5.el7
0:1.35.0-5.el7
redhat/python-receptor-satellite<0:1.2.0-1.el7
0:1.2.0-1.el7
redhat/python-simplejson<0:3.2.0-1.el7
0:3.2.0-1.el7
redhat/python-six<0:1.11.0-8.el7a
0:1.11.0-8.el7a
redhat/python-twisted<0:16.4.1-12.el7
0:16.4.1-12.el7
redhat/python-typing-extensions<0:3.7.4.1-2.el7a
0:3.7.4.1-2.el7a
redhat/python-vine<10:1.1.3-6.el7
10:1.1.3-6.el7
redhat/python-werkzeug<0:0.12.2-5.el7
0:0.12.2-5.el7
redhat/python-yarl<0:1.4.2-2.el7a
0:1.4.2-2.el7a
redhat/python-zope-interface<0:4.0.5-4.el7
0:4.0.5-4.el7
redhat/qpid-cpp<0:1.36.0-28.el7a
0:1.36.0-28.el7a
redhat/qpid-dispatch<0:1.5.0-4.el7
0:1.5.0-4.el7
redhat/qpid-proton<0:0.28.0-3.el7
0:0.28.0-3.el7
redhat/receptor<0:0.6.3-1.el7a
0:0.6.3-1.el7a
redhat/redhat-access-insights-puppet<0:1.0.1-1.el7
0:1.0.1-1.el7
redhat/repoview<0:0.6.6-11.el7
0:0.6.6-11.el7
redhat/rhel8-kickstart-setup<0:0.0.2-1.el7
0:0.0.2-1.el7
redhat/rh-postgresql12-postgresql-evr<0:0.0.2-1.el7
0:0.0.2-1.el7
redhat/rubygem-facter<0:2.4.1-2.el7
0:2.4.1-2.el7
redhat/rubygem-highline<0:1.7.8-3.el7
0:1.7.8-3.el7
redhat/rubygem-newt<0:0.9.6-3.el7
0:0.9.6-3.el7
redhat/rubygem-oauth<0:0.5.4-2.el7
0:0.5.4-2.el7
redhat/rubygem-passenger<0:4.0.18-24.el7
0:4.0.18-24.el7
redhat/rubygem-rack<1:1.6.12-1.el7
1:1.6.12-1.el7
redhat/rubygem-rake<0:0.9.2.2-41.el7
0:0.9.2.2-41.el7
redhat/saslwrapper<0:0.22-5.el7
0:0.22-5.el7
redhat/satellite<0:6.8.0-1.el7
0:6.8.0-1.el7
redhat/satellite-installer<0:6.8.0.11-1.el7
0:6.8.0.11-1.el7
redhat/tfm<0:6.1-1.el7
0:6.1-1.el7
redhat/tfm-rubygem-actioncable<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-actionmailbox<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-actionmailer<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-actionpack<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-actiontext<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-actionview<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-activejob<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-activemodel<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-activerecord<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-activerecord-import<0:1.0.0-6.el7
0:1.0.0-6.el7
redhat/tfm-rubygem-activestorage<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-activesupport<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-addressable<0:2.6.0-1.el7
0:2.6.0-1.el7
redhat/tfm-rubygem-algebrick<0:0.7.3-6.el7
0:0.7.3-6.el7
redhat/tfm-rubygem-ancestry<0:3.0.7-1.el7
0:3.0.7-1.el7
redhat/tfm-rubygem-anemone<0:0.7.2-22.el7
0:0.7.2-22.el7
redhat/tfm-rubygem-angular-rails-templates<1:1.1.0-1.el7
1:1.1.0-1.el7
redhat/tfm-rubygem-ansi<0:1.5.0-2.el7
0:1.5.0-2.el7
redhat/tfm-rubygem-apipie-bindings<0:0.3.0-1.el7
0:0.3.0-1.el7
redhat/tfm-rubygem-apipie-dsl<0:2.2.2-2.el7
0:2.2.2-2.el7
redhat/tfm-rubygem-apipie-params<0:0.0.5-5.el7
0:0.0.5-5.el7
redhat/tfm-rubygem-apipie-rails<0:0.5.17-3.el7
0:0.5.17-3.el7
redhat/tfm-rubygem-audited<0:4.9.0-3.el7
0:4.9.0-3.el7
redhat/tfm-rubygem-bcrypt<0:3.1.12-1.el7
0:3.1.12-1.el7
redhat/tfm-rubygem-builder<0:3.2.4-1.el7
0:3.2.4-1.el7
redhat/tfm-rubygem-clamp<0:1.1.2-5.el7
0:1.1.2-5.el7
redhat/tfm-rubygem-coffee-rails<0:5.0.0-1.el7
0:5.0.0-1.el7
redhat/tfm-rubygem-coffee-script<0:2.4.1-4.el7
0:2.4.1-4.el7
redhat/tfm-rubygem-coffee-script-source<0:1.12.2-4.el7
0:1.12.2-4.el7
redhat/tfm-rubygem-concurrent-ruby<1:1.1.6-2.el7
1:1.1.6-2.el7
redhat/tfm-rubygem-concurrent-ruby-edge<1:0.6.0-2.el7
1:0.6.0-2.el7
redhat/tfm-rubygem-crass<0:1.0.6-1.el7
0:1.0.6-1.el7
redhat/tfm-rubygem-daemons<0:1.2.3-7.el7
0:1.2.3-7.el7
redhat/tfm-rubygem-deacon<0:1.0.0-4.el7
0:1.0.0-4.el7
redhat/tfm-rubygem-declarative<0:0.0.10-1.el7
0:0.0.10-1.el7
redhat/tfm-rubygem-declarative-option<0:0.1.0-1.el7
0:0.1.0-1.el7
redhat/tfm-rubygem-deface<0:1.5.3-2.el7
0:1.5.3-2.el7
redhat/tfm-rubygem-diffy<0:3.0.1-6.el7
0:3.0.1-6.el7
redhat/tfm-rubygem-dynflow<0:1.4.7-1.fm2_1.el7
0:1.4.7-1.fm2_1.el7
redhat/tfm-rubygem-erubi<0:1.9.0-1.el7
0:1.9.0-1.el7
redhat/tfm-rubygem-excon<0:0.58.0-3.el7
0:0.58.0-3.el7
redhat/tfm-rubygem-execjs<0:2.7.0-4.el7
0:2.7.0-4.el7
redhat/tfm-rubygem-facter<0:2.4.0-6.el7
0:2.4.0-6.el7
redhat/tfm-rubygem-faraday<0:0.15.4-1.el7
0:0.15.4-1.el7
redhat/tfm-rubygem-ffi<0:1.12.2-1.el7
0:1.12.2-1.el7
redhat/tfm-rubygem-fog-aws<0:3.6.5-1.el7
0:3.6.5-1.el7
redhat/tfm-rubygem-fog-core<0:2.1.0-3.el7
0:2.1.0-3.el7
redhat/tfm-rubygem-fog-google<0:1.8.2-1.el7
0:1.8.2-1.el7
redhat/tfm-rubygem-fog-json<0:1.2.0-3.el7
0:1.2.0-3.el7
redhat/tfm-rubygem-fog-kubevirt<0:1.3.3-1.el7
0:1.3.3-1.el7
redhat/tfm-rubygem-fog-libvirt<0:0.7.0-1.el7
0:0.7.0-1.el7
redhat/tfm-rubygem-fog-openstack<0:1.0.8-2.el7
0:1.0.8-2.el7
redhat/tfm-rubygem-fog-ovirt<0:1.2.5-1.el7
0:1.2.5-1.el7
redhat/tfm-rubygem-fog-vsphere<0:3.3.1-1.el7
0:3.3.1-1.el7
redhat/tfm-rubygem-fog-xml<0:0.1.2-8.el7
0:0.1.2-8.el7
redhat/tfm-rubygem-foreman-tasks<0:2.0.2-1.fm2_1.el7
0:2.0.2-1.fm2_1.el7
redhat/tfm-rubygem-foreman-tasks-core<0:0.3.4-1.el7
0:0.3.4-1.el7
redhat/tfm-rubygem-formatador<0:0.2.1-11.el7
0:0.2.1-11.el7
redhat/tfm-rubygem-fx<0:0.5.0-1.el7
0:0.5.0-1.el7
redhat/tfm-rubygem-gettext<0:3.1.4-10.el7
0:3.1.4-10.el7
redhat/tfm-rubygem-git<0:1.5.0-1.el7
0:1.5.0-1.el7
redhat/tfm-rubygem-gitlab-sidekiq-fetcher<0:0.5.2-2.el7
0:0.5.2-2.el7
redhat/tfm-rubygem-globalid<0:0.4.2-1.el7
0:0.4.2-1.el7
redhat/tfm-rubygem-google-api-client<0:0.23.9-3.el7
0:0.23.9-3.el7
redhat/tfm-rubygem-googleauth<0:0.6.7-3.el7
0:0.6.7-3.el7
redhat/tfm-rubygem-graphql<0:1.8.14-1.el7
0:1.8.14-1.el7
redhat/tfm-rubygem-graphql-batch<0:0.3.10-1.el7
0:0.3.10-1.el7
redhat/tfm-rubygem-gssapi<0:1.2.0-6.el7
0:1.2.0-6.el7
redhat/tfm-rubygem-hashie<0:3.6.0-1.el7
0:3.6.0-1.el7
redhat/tfm-rubygem-highline<0:1.7.8-4.el7
0:1.7.8-4.el7
redhat/tfm-rubygem-http<0:3.3.0-1.el7
0:3.3.0-1.el7
redhat/tfm-rubygem-httpclient<0:2.8.3-1.el7
0:2.8.3-1.el7
redhat/tfm-rubygem-http-cookie<0:1.0.2-5.el7
0:1.0.2-5.el7
redhat/tfm-rubygem-i18n<0:1.8.2-1.el7
0:1.8.2-1.el7
redhat/tfm-rubygem-infoblox<0:3.0.0-3.el7
0:3.0.0-3.el7
redhat/tfm-rubygem-ipaddress<0:0.8.0-11.el7
0:0.8.0-11.el7
redhat/tfm-rubygem-jgrep<0:1.3.3-12.el7
0:1.3.3-12.el7
redhat/tfm-rubygem-journald-logger<0:2.0.4-2.el7
0:2.0.4-2.el7
redhat/tfm-rubygem-journald-native<0:1.0.11-2.el7
0:1.0.11-2.el7
redhat/tfm-rubygem-jwt<0:2.2.1-1.el7
0:2.2.1-1.el7
redhat/tfm-rubygem-kafo<0:4.1.0-3.el7
0:4.1.0-3.el7
redhat/tfm-rubygem-katello<0:3.16.0.11-1.el7
0:3.16.0.11-1.el7
redhat/tfm-rubygem-kubeclient<0:4.3.0-1.el7
0:4.3.0-1.el7
redhat/tfm-rubygem-little-plugger<0:1.1.4-1.el7
0:1.1.4-1.el7
redhat/tfm-rubygem-locale<0:2.0.9-13.el7
0:2.0.9-13.el7
redhat/tfm-rubygem-logging<0:2.2.2-6.el7
0:2.2.2-6.el7
redhat/tfm-rubygem-logging-journald<0:2.0.0-2.el7
0:2.0.0-2.el7
redhat/tfm-rubygem-loofah<0:2.4.0-1.el7
0:2.4.0-1.el7
redhat/tfm-rubygem-mail<0:2.7.1-1.el7
0:2.7.1-1.el7
redhat/tfm-rubygem-marcel<0:0.3.3-1.el7
0:0.3.3-1.el7
redhat/tfm-rubygem-memoist<0:0.16.0-1.el7
0:0.16.0-1.el7
redhat/tfm-rubygem-mimemagic<0:0.3.5-1.el7
0:0.3.5-1.el7
redhat/tfm-rubygem-mime-types<0:3.2.2-4.el7
0:3.2.2-4.el7
redhat/tfm-rubygem-mime-types-data<0:3.2018.0812-4.el7
0:3.2018.0812-4.el7
redhat/tfm-rubygem-multipart-post<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/tfm-rubygem-mustermann<0:1.0.2-4.el7
0:1.0.2-4.el7
redhat/tfm-rubygem-net-ldap<0:0.16.1-1.el7
0:0.16.1-1.el7
redhat/tfm-rubygem-net-ping<0:2.0.1-3.el7
0:2.0.1-3.el7
redhat/tfm-rubygem-netrc<0:0.11.0-3.el7
0:0.11.0-3.el7
redhat/tfm-rubygem-net-scp<0:1.2.1-3.el7
0:1.2.1-3.el7
redhat/tfm-rubygem-net-ssh<0:4.2.0-1.el7
0:4.2.0-1.el7
redhat/tfm-rubygem-net-ssh-krb<0:0.4.0-3.el7
0:0.4.0-3.el7
redhat/tfm-rubygem-nio4r<0:2.5.2-2.el7
0:2.5.2-2.el7
redhat/tfm-rubygem-nokogiri<0:1.10.9-1.el7
0:1.10.9-1.el7
redhat/tfm-rubygem-oauth<0:0.5.4-3.el7
0:0.5.4-3.el7
redhat/tfm-rubygem-openscap<0:0.4.9-3.el7
0:0.4.9-3.el7
redhat/tfm-rubygem-optimist<0:3.0.0-1.el7
0:3.0.0-1.el7
redhat/tfm-rubygem-os<0:1.0.0-1.el7
0:1.0.0-1.el7
redhat/tfm-rubygem-ovirt-engine-sdk<0:4.2.3-3.el7
0:4.2.3-3.el7
redhat/tfm-rubygem-parse-cron<0:0.1.4-4.el7
0:0.1.4-4.el7
redhat/tfm-rubygem-passenger<0:4.0.18-26.el7
0:4.0.18-26.el7
redhat/tfm-rubygem-pg<0:1.1.4-2.el7
0:1.1.4-2.el7
redhat/tfm-rubygem-polyglot<0:0.3.5-3.el7
0:0.3.5-3.el7
redhat/tfm-rubygem-powerbar<0:2.0.1-2.el7
0:2.0.1-2.el7
redhat/tfm-rubygem-prometheus-client<0:1.0.0-1.el7
0:1.0.0-1.el7
redhat/tfm-rubygem-promise.rb<0:0.7.4-1.el7
0:0.7.4-1.el7
redhat/tfm-rubygem-puma<0:4.3.3-4.el7
0:4.3.3-4.el7
redhat/tfm-rubygem-puma-plugin-systemd<0:0.1.5-1.el7
0:0.1.5-1.el7
redhat/tfm-rubygem-quantile<0:0.2.0-3.el7
0:0.2.0-3.el7
redhat/tfm-rubygem-rabl<0:0.14.3-1.el7
0:0.14.3-1.el7
redhat/tfm-rubygem-rack<0:2.2.3-1.el7
0:2.2.3-1.el7
redhat/tfm-rubygem-rack-cors<0:1.0.2-1.el7
0:1.0.2-1.el7
redhat/tfm-rubygem-rack-jsonp<0:1.3.1-9.el7
0:1.3.1-9.el7
redhat/tfm-rubygem-rack-protection<0:2.0.3-4.el7
0:2.0.3-4.el7
redhat/tfm-rubygem-rack-test<0:1.1.0-4.el7
0:1.1.0-4.el7
redhat/tfm-rubygem-rails<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-rails-dom-testing<0:2.0.3-6.el7
0:2.0.3-6.el7
redhat/tfm-rubygem-rails-html-sanitizer<0:1.3.0-1.el7
0:1.3.0-1.el7
redhat/tfm-rubygem-rails-i18n<0:6.0.0-2.el7
0:6.0.0-2.el7
redhat/tfm-rubygem-railties<0:6.0.3.1-1.el7
0:6.0.3.1-1.el7
redhat/tfm-rubygem-rainbow<0:2.2.1-5.el7
0:2.2.1-5.el7
redhat/tfm-rubygem-rb-inotify<0:0.9.7-5.el7
0:0.9.7-5.el7
redhat/tfm-rubygem-rbovirt<0:0.1.7-4.el7
0:0.1.7-4.el7
redhat/tfm-rubygem-rbvmomi<0:2.2.0-3.el7
0:2.2.0-3.el7
redhat/tfm-rubygem-recursive-open-struct<0:1.1.0-1.el7
0:1.1.0-1.el7
redhat/tfm-rubygem-redis<0:4.1.2-2.el7
0:4.1.2-2.el7
redhat/tfm-rubygem-representable<0:3.0.4-1.el7
0:3.0.4-1.el7
redhat/tfm-rubygem-responders<0:3.0.0-3.el7
0:3.0.0-3.el7
redhat/tfm-rubygem-rest-client<0:2.0.2-3.el7
0:2.0.2-3.el7
redhat/tfm-rubygem-retriable<0:3.1.2-1.el7
0:3.1.2-1.el7
redhat/tfm-rubygem-rkerberos<0:0.1.5-18.el7
0:0.1.5-18.el7
redhat/tfm-rubygem-roadie<0:3.4.0-3.el7
0:3.4.0-3.el7
redhat/tfm-rubygem-roadie-rails<0:2.1.1-2.el7
0:2.1.1-2.el7
redhat/tfm-rubygem-robotex<0:1.0.0-21.el7
0:1.0.0-21.el7
redhat/tfm-rubygem-rsec<0:0.4.3-4.el7
0:0.4.3-4.el7
redhat/tfm-rubygem-ruby2ruby<0:2.4.2-3.el7
0:2.4.2-3.el7
redhat/tfm-rubygem-rubyipmi<0:0.10.0-6.el7
0:0.10.0-6.el7
redhat/tfm-rubygem-ruby-libvirt<0:0.7.0-4.el7
0:0.7.0-4.el7
redhat/tfm-rubygem-runcible<0:2.13.0-2.el7
0:2.13.0-2.el7
redhat/tfm-rubygem-safemode<0:1.3.5-2.el7
0:1.3.5-2.el7
redhat/tfm-rubygem-sequel<0:5.7.1-2.el7
0:5.7.1-2.el7
redhat/tfm-rubygem-sidekiq<0:5.2.7-3.el7
0:5.2.7-3.el7
redhat/tfm-rubygem-signet<0:0.11.0-3.el7
0:0.11.0-3.el7
redhat/tfm-rubygem-sinatra<0:2.0.3-4.el7
0:2.0.3-4.el7
redhat/tfm-rubygem-sprockets<0:3.7.2-6.el7
0:3.7.2-6.el7
redhat/tfm-rubygem-sprockets-rails<0:3.2.1-6.el7
0:3.2.1-6.el7
redhat/tfm-rubygem-sqlite3<0:1.3.13-5.el7
0:1.3.13-5.el7
redhat/tfm-rubygem-sshkey<0:1.9.0-3.el7
0:1.9.0-3.el7
redhat/tfm-rubygem-statsd-instrument<0:2.1.4-2.el7
0:2.1.4-2.el7
redhat/tfm-rubygem-stomp<0:1.4.9-1.el7
0:1.4.9-1.el7
redhat/tfm-rubygem-text<0:1.3.0-7.el7
0:1.3.0-7.el7
redhat/tfm-rubygem-thor<0:1.0.1-2.el7
0:1.0.1-2.el7
redhat/tfm-rubygem-tilt<0:2.0.8-4.el7
0:2.0.8-4.el7
redhat/tfm-rubygem-timeliness<0:0.3.10-1.el7
0:0.3.10-1.el7
redhat/tfm-rubygem-tzinfo<0:1.2.6-1.el7
0:1.2.6-1.el7
redhat/tfm-rubygem-uber<0:0.1.0-1.el7
0:0.1.0-1.el7
redhat/tfm-rubygem-unf<0:0.1.3-7.el7
0:0.1.3-7.el7
redhat/tfm-rubygem-unicode<0:0.4.4.4-1.el7
0:0.4.4.4-1.el7
redhat/tfm-rubygem-webpack-rails<0:0.9.8-6.el7
0:0.9.8-6.el7
redhat/tfm-rubygem-websocket-driver<0:0.7.1-1.el7
0:0.7.1-1.el7
redhat/tfm-rubygem-websocket-extensions<0:0.1.5-1.el7
0:0.1.5-1.el7
redhat/tfm-rubygem-x-editable-rails<0:1.5.5-5.el7
0:1.5.5-5.el7
redhat/tfm-rubygem-xmlrpc<0:0.3.0-2.el7
0:0.3.0-2.el7
redhat/tfm-rubygem-zeitwerk<0:2.2.2-1.el7
0:2.2.2-1.el7
redhat/ansible-collection-redhat-satellite<0:2.0.1-1.el7
0:2.0.1-1.el7
redhat/candlepin<0:3.1.26-1.el7
0:3.1.26-1.el7
redhat/foreman<0:2.3.1.20-1.el7
0:2.3.1.20-1.el7
redhat/foreman-discovery-image-service<0:1.0.0-4.el7
0:1.0.0-4.el7
redhat/foreman-installer<1:2.3.1.10-1.el7
1:2.3.1.10-1.el7
redhat/foreman-proxy<0:2.3.1-1.el7
0:2.3.1-1.el7
redhat/foreman-selinux<0:2.3.1-1.el7
0:2.3.1-1.el7
redhat/katello<0:3.18.1-3.el7
0:3.18.1-3.el7
redhat/katello-certs-tools<0:2.7.3-1.el7
0:2.7.3-1.el7
redhat/katello-selinux<0:3.5.1-1.el7
0:3.5.1-1.el7
redhat/keycloak-httpd-client-install<0:1.2.2-2.el7
0:1.2.2-2.el7
redhat/libcomps<0:0.1.15-1.el7
0:0.1.15-1.el7
redhat/libmodulemd2<0:2.9.3-1.el7
0:2.9.3-1.el7
redhat/libsolv<0:0.7.12-2.el7
0:0.7.12-2.el7
redhat/pulp<0:2.21.5-2.el7
0:2.21.5-2.el7
redhat/pulpcore-selinux<0:1.2.3-2.el7
0:1.2.3-2.el7
redhat/pulp-docker<0:3.2.9-1.el7
0:3.2.9-1.el7
redhat/pulp-puppet<0:2.21.5-2.el7
0:2.21.5-2.el7
redhat/pulp-rpm<0:2.21.5-2.el7
0:2.21.5-2.el7
redhat/puppet-agent<0:6.19.1-2.el7
0:6.19.1-2.el7
redhat/puppetlabs-stdlib<0:5.2.0-1.el7
0:5.2.0-1.el7
redhat/puppetserver<0:6.14.1-1.el7
0:6.14.1-1.el7
redhat/python3-cairo<0:1.10.0-25.el7
0:1.10.0-25.el7
redhat/python3-chardet<0:3.0.4-3.el7
0:3.0.4-3.el7
redhat/python3-click<0:7.1.2-3.el7
0:7.1.2-3.el7
redhat/python3-django<0:2.2.18-1.el7
0:2.2.18-1.el7
redhat/python3-gnupg<0:0.4.6-3.el7
0:0.4.6-3.el7
redhat/python3-gobject<0:3.22.0-8.el7
0:3.22.0-8.el7
redhat/python3-iniparse<0:0.4-33.el7
0:0.4-33.el7
redhat/python3-jinja2<0:2.11.2-3.el7
0:2.11.2-3.el7
redhat/python3-markupsafe<0:1.1.1-4.el7
0:1.1.1-4.el7
redhat/python3-mongoengine<0:0.20.0-3.el7
0:0.20.0-3.el7
redhat/python3-pymongo<0:3.11.0-3.el7
0:3.11.0-3.el7
redhat/python3-rpm<0:4.11.3-8.el7
0:4.11.3-8.el7
redhat/python3-semantic-version<0:2.8.5-3.el7
0:2.8.5-3.el7
redhat/python-aiodns<0:2.0.0-3.el7
0:2.0.0-3.el7
redhat/python-aiofiles<0:0.6.0-1.el7
0:0.6.0-1.el7
redhat/python-async-timeout<0:3.0.1-2.el7
0:3.0.1-2.el7
redhat/python-attrs<0:19.3.0-2.el7
0:19.3.0-2.el7
redhat/python-backoff<0:1.10.0-3.el7
0:1.10.0-3.el7
redhat/python-certifi<0:2020.6.20-1.el7
0:2020.6.20-1.el7
redhat/python-cffi<0:1.14.3-1.el7
0:1.14.3-1.el7
redhat/python-cryptography<0:2.9.2-1.el7
0:2.9.2-1.el7
redhat/python-dateutil<0:2.8.1-3.el7
0:2.8.1-3.el7
redhat/python-defusedxml<0:0.6.0-1.el7
0:0.6.0-1.el7
redhat/python-diff-match-patch<0:20200713-1.el7
0:20200713-1.el7
redhat/python-django-currentuser<0:0.5.1-1.el7
0:0.5.1-1.el7
redhat/python-django-filter<0:2.3.0-1.el7
0:2.3.0-1.el7
redhat/python-django-guardian<0:2.3.0-1.el7
0:2.3.0-1.el7
redhat/python-django-import-export<0:2.3.0-1.el7
0:2.3.0-1.el7
redhat/python-django-lifecycle<0:0.8.0-1.el7
0:0.8.0-1.el7
redhat/python-django-prometheus<0:2.1.0-1.el7
0:2.1.0-1.el7
redhat/python-django-readonly-field<0:1.0.5-1.el7
0:1.0.5-1.el7
redhat/python-djangorestframework<0:3.11.2-1.el7
0:3.11.2-1.el7
redhat/python-djangorestframework-queryfields<0:1.0.0-3.el7
0:1.0.0-3.el7
redhat/python-drf-access-policy<0:0.7.0-1.el7
0:0.7.0-1.el7
redhat/python-drf-nested-routers<0:0.91-2.el7
0:0.91-2.el7
redhat/python-drf-spectacular<0:0.9.13-1.el7
0:0.9.13-1.el7
redhat/python-dynaconf<0:3.1.2-1.el7
0:3.1.2-1.el7
redhat/python-ecdsa<0:0.13.3-2.el7
0:0.13.3-2.el7
redhat/python-et-xmlfile<0:1.0.1-1.el7
0:1.0.1-1.el7
redhat/python-future<0:0.18.2-3.el7
0:0.18.2-3.el7
redhat/python-gunicorn<0:20.0.4-2.el7
0:20.0.4-2.el7
redhat/python-idna<0:2.10-1.el7
0:2.10-1.el7
redhat/python-idna-ssl<0:1.1.0-3.el7
0:1.1.0-3.el7
redhat/python-importlib-metadata<0:1.7.0-1.el7
0:1.7.0-1.el7
redhat/python-inflection<0:0.5.1-1.el7
0:0.5.1-1.el7
redhat/python-jdcal<0:1.4.1-1.el7
0:1.4.1-1.el7
redhat/python-jsonschema<0:3.2.0-4.el7
0:3.2.0-4.el7
redhat/python-kombu<10:4.0.2-14.el7
10:4.0.2-14.el7
redhat/python-markuppy<0:1.14-1.el7
0:1.14-1.el7
redhat/python-multidict<0:4.7.6-1.el7
0:4.7.6-1.el7
redhat/python-nectar<0:1.6.4-1.el7
0:1.6.4-1.el7
redhat/python-odfpy<0:1.4.1-2.el7
0:1.4.1-2.el7
redhat/python-openpyxl<0:3.0.5-1.el7
0:3.0.5-1.el7
redhat/python-productmd<0:1.31-1.el7
0:1.31-1.el7
redhat/python-psutil<0:5.7.2-2.el7
0:5.7.2-2.el7
redhat/python-psycopg2<0:2.8.6-1.el7
0:2.8.6-1.el7
redhat/python-pulp-certguard<0:1.0.3-1.el7
0:1.0.3-1.el7
redhat/python-pulp-container<0:2.1.1-1.el7
0:2.1.1-1.el7
redhat/python-pulpcore<0:3.7.3-2.el7
0:3.7.3-2.el7
redhat/python-pulp-file<0:1.3.0-1.el7
0:1.3.0-1.el7
redhat/python-pulp-rpm<0:3.9.0-1.el7
0:3.9.0-1.el7
redhat/python-pycares<0:3.1.1-2.el7
0:3.1.1-2.el7
redhat/python-pycparser<0:2.20-1.el7
0:2.20-1.el7
redhat/python-pycryptodomex<0:3.9.8-1.el7
0:3.9.8-1.el7
redhat/python-pygtrie<0:2.3.3-1.el7
0:2.3.3-1.el7
redhat/python-pyjwkest<0:1.4.2-2.el7
0:1.4.2-2.el7
redhat/python-pyjwt<0:1.7.1-3.el7
0:1.7.1-3.el7
redhat/python-pyrsistent<0:0.17.3-1.el7
0:0.17.3-1.el7
redhat/python-pytz<0:2020.4-1.el7
0:2020.4-1.el7
redhat/python-pyyaml<0:5.3.1-3.el7
0:5.3.1-3.el7
redhat/python-receptor-satellite<0:1.3.2-1.el7
0:1.3.2-1.el7
redhat/python-redis<0:3.5.3-1.el7
0:3.5.3-1.el7
redhat/python-requests<0:2.24.0-1.el7
0:2.24.0-1.el7
redhat/python-rq<0:1.5.2-2.el7
0:1.5.2-2.el7
redhat/python-six<0:1.15.0-1.el7
0:1.15.0-1.el7
redhat/python-sqlparse<0:0.4.1-1.el7
0:0.4.1-1.el7
redhat/python-tablib<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/python-typing<0:3.7.4.3-1.el7
0:3.7.4.3-1.el7
redhat/python-typing-extensions<0:3.7.4.3-1.el7
0:3.7.4.3-1.el7
redhat/python-uritemplate<0:3.0.1-2.el7
0:3.0.1-2.el7
redhat/python-urllib3<0:1.25.11-1.el7
0:1.25.11-1.el7
redhat/python-urlman<0:1.3.0-2.el7
0:1.3.0-2.el7
redhat/python-url-normalize<0:1.4.3-2.el7
0:1.4.3-2.el7
redhat/python-whitenoise<0:5.2.0-1.el7
0:5.2.0-1.el7
redhat/python-xlrd<0:1.2.0-1.el7
0:1.2.0-1.el7
redhat/python-xlwt<0:1.3.0-1.el7
0:1.3.0-1.el7
redhat/python-yarl<0:1.6.2-1.el7
0:1.6.2-1.el7
redhat/python-zipp<0:3.4.0-2.el7
0:3.4.0-2.el7
redhat/qpid-proton<0:0.28.0-4.el7
0:0.28.0-4.el7
redhat/satellite<0:6.9.0-1.el7
0:6.9.0-1.el7
redhat/satellite-installer<0:6.9.0.10-1.el7
0:6.9.0.10-1.el7
redhat/subscription-manager<0:1.27.5-4.el7
0:1.27.5-4.el7
redhat/tfm<0:6.1-4.el7
0:6.1-4.el7
redhat/tfm-rubygem-actioncable<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-actionmailbox<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-actionmailer<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-actionpack<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-actiontext<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-actionview<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-activejob<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-activemodel<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-activerecord<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-activestorage<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-activesupport<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-apipie-bindings<0:0.4.0-1.el7
0:0.4.0-1.el7
redhat/tfm-rubygem-apipie-dsl<0:2.3.0-1.el7
0:2.3.0-1.el7
redhat/tfm-rubygem-excon<0:0.76.0-1.el7
0:0.76.0-1.el7
redhat/tfm-rubygem-faraday<0:0.17.3-1.el7
0:0.17.3-1.el7
redhat/tfm-rubygem-fog-google<0:1.11.0-1.el7
0:1.11.0-1.el7
redhat/tfm-rubygem-fog-vsphere<0:3.4.0-1.el7
0:3.4.0-1.el7
redhat/tfm-rubygem-foreman-tasks<0:3.0.5-1.el7
0:3.0.5-1.el7
redhat/tfm-rubygem-gitlab-sidekiq-fetcher<0:0.6.0-1.el7
0:0.6.0-1.el7
redhat/tfm-rubygem-google-api-client<0:0.33.2-1.el7
0:0.33.2-1.el7
redhat/tfm-rubygem-googleauth<0:0.13.1-1.el7
0:0.13.1-1.el7
redhat/tfm-rubygem-google-cloud-env<0:1.3.3-1.el7
0:1.3.3-1.el7
redhat/tfm-rubygem-kafo<0:6.2.1-1.el7
0:6.2.1-1.el7
redhat/tfm-rubygem-katello<0:3.18.1.22-1.el7
0:3.18.1.22-1.el7
redhat/tfm-rubygem-logging<0:2.3.0-1.el7
0:2.3.0-1.el7
redhat/tfm-rubygem-newt<0:0.9.7-2.el7
0:0.9.7-2.el7
redhat/tfm-rubygem-nio4r<0:2.5.4-1.el7
0:2.5.4-1.el7
redhat/tfm-rubygem-openscap<0:0.4.9-4.el7
0:0.4.9-4.el7
redhat/tfm-rubygem-ovirt-engine-sdk<0:4.3.0-1.el7
0:4.3.0-1.el7
redhat/tfm-rubygem-puma<0:4.3.6-1.el7
0:4.3.6-1.el7
redhat/tfm-rubygem-rails<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-railties<0:6.0.3.4-1.el7
0:6.0.3.4-1.el7
redhat/tfm-rubygem-ruby-libvirt<0:0.7.1-1.el7
0:0.7.1-1.el7
redhat/tfm-rubygem-runcible<0:2.13.1-1.el7
0:2.13.1-1.el7
redhat/tfm-rubygem-safemode<0:1.3.6-1.el7
0:1.3.6-1.el7
redhat/tfm-rubygem-signet<0:0.14.0-1.el7
0:0.14.0-1.el7
redhat/tfm-rubygem-sprockets<0:4.0.2-1.el7
0:4.0.2-1.el7
redhat/Rack<1.6.12
1.6.12
redhat/Rack<2.0.8
2.0.8
Rack Rack Ruby<1.6.12
Rack Rack Ruby>=2.0.0<2.0.8
Fedoraproject Fedora=31
openSUSE Leap=15.1
Rack Project Rack Ruby<1.6.12
Rack Project Rack Ruby>=2.0.0<2.0.8
debian/ruby-rack
2.1.4-3+deb11u22.1.4-3+deb11u32.2.6.4-1+deb12u12.2.13-1~deb12u13.1.12-1
Remediation
Patch Available
Information
There is no mitigation for this issue, the flaw can only be resolved by applying updates.
Event History
Dec 18, 2019
CVE Published
12:00 AM
CVE Published
via MITRE·07:05 PM
Data Sourced
via MITRE·07:05 PM
DescriptionSeverityWeakness
Jan 8, 2020
Data Sourced
via Red Hat·06:14 PM
DescriptionSeverityAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:22 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·01:44 AM
RemedyDescriptionSeverityAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2019-16782?
CVE-2019-16782 has a severity rating that indicates a high threat to data confidentiality due to the potential for session hijacking.
2
How do I fix CVE-2019-16782?
To remediate CVE-2019-16782, upgrade to Rack version 1.6.12 or 2.0.8 or later as specified in the security advisories.
3
Which versions of Rack are affected by CVE-2019-16782?
CVE-2019-16782 affects Rack versions prior to 1.6.12 and 2.0.8.
4
What kind of attacks does CVE-2019-16782 protect against?
CVE-2019-16782 addresses vulnerabilities that allow for timing attacks targeting session IDs, potentially leading to session hijacking.
5
Is there a patch available for CVE-2019-16782?
Yes, patches are available in the form of updates to Rack versions 1.6.12 and 2.0.8.