In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-excon | Jan 20, 2020 | Dec 16, 2019 |
| Freebsd | — | Upgrade gitlab-ce | Feb 1, 2020 | Jan 31, 2020 |
| Suse | — | Upgrade ruby2.5-rubygem-excon-docUpgrade ruby2.1-rubygem-exconUpgrade ruby2.5-rubygem-excon-testsuiteUpgrade ruby2.5-rubygem-excon | Jan 15, 2020 | Dec 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub