CVE-2019-16779
Medium
Description
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
SeverityMedium
CVSS5.8
Exploit probability—
Product
Excon
PublishedDec 16, 2019
First seenDec 16, 2019
Weakness typeCWE-664CWE-664
How to fix
Update
- excon_project excon0.71.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| excon_project excon | v < 0.71.0 | 0.71.0 |
| opensuse backports_sle | 15.0 | — |
| opensuse leap | 15.1 | — |
| debian debian_linux | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.