CVE-2019-16779 MEDIUM

CVE-2019-16779: In RubyGem excon, interrupted Persistent Connections May Leak Response Data

Vendor Excon
Product excon
Weakness CWE-664
Published December 16, 2019
Last update August 5, 2024

CVSS base score

5.8/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

Key dates

02Disclosure timeline

December 16, 2019 CVE published
August 5, 2024 Record updated