CVE-2019-16779 In RubyGem excon, interrupted Persistent Connections May Leak Response Data

Medium 5.8 Published 16 Dec 2019 Updated 5 Aug 2024

A race condition in the excon Ruby library allows attackers to read leaked response data from previous requests via persistent connections.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-16779?

CVE-2019-16779 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Dec 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

Weakness: CWE-362, CWE-664

Which versions are affected by CVE-2019-16779?

2 open source packages ship an affected version, including excon. It affects 4 products.

Package	Affected	Fixed in
`excon` RubyGems	All versions	`0.71.0`
`excon` RubyGems	All versions	`0.71.0`

Linux distribution packages (3)

`rubygem-excon` SUSE:Linux Enterprise Module for Containers 12	All versions	`0.52.0-12.3.8`
`rubygem-excon` SUSE:Package Hub 15 SP1	All versions	`0.59.0-bp151.4.3.1`
`rubygem-excon` openSUSE:Leap 15.1	All versions	`0.59.0-lp151.3.3.1`

Products include Debian Debian Linux, Excon Project Excon, Opensuse Backports Sle, Opensuse Leap.

How do I fix CVE-2019-16779?

Upgrade excon to 0.71.0 or later.

Is CVE-2019-16779 being exploited?

There is no known exploitation of CVE-2019-16779 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-16779, DLA-2070-1, GHSA-q58g-455p-8vw9, OESA-2021-1420, SUSE-SU-2020:2053-1, UBUNTU-CVE-2019-16779 and 2 more.