GitHub Advisoryadvisory · RubyGems

GHSA-688c-3x49-6rqj rack-protection gem timing attack vulnerability when validating CSRF token

MEDIUM Published 2018-03-07 Modified 2023-08-29 Official page ↗
Aliases
CVE-2018-1000119
Ecosystem
RubyGems
Packages
rack-protection
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203
Reviewed
2020-06-16

Affected packages

• RubyGems rack-protection: < 1.5.5 → fixed in 1.5.5 • RubyGems rack-protection: >= 2.0.0.beta1, < 2.0.0 → fixed in 2.0.0

Description

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Related

Alias · CVE (1)

  • CVE-2018-1000119 Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References