CVE-2019-16782 Possible Information Leak / Session Hijack Vulnerability in Rack
Attackers can hijack sessions via timing attacks on session ID lookups in the Rack library, leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16782?
CVE-2019-16782 is a medium-severity vulnerability in Fedoraproject Fedora, published on 18 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
Which versions are affected by CVE-2019-16782?
4 open source packages ship an affected version, including rack. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | All versions | 1.6.12 |
rack RubyGems | All versions | 1.6.12 |
rack RubyGems | From 2.0.0 | 2.0.8 |
rack RubyGems | From 2.0.0 | 2.0.8 |
Linux distribution packages (14)
ansible-runner Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:1.4.6-1.el8ar |
cfme Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.6.0-1.el8cf |
cfme-amazon-smartstate Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.6.0-1.el8cf |
cfme-appliance Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.6.0-1.el8cf |
cfme-appliance-common Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.6.0-1.el8cf |
cfme-appliance-tools Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.6.0-1.el8cf |
cfme-gemset Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.6.0-1.el8cf |
libssh2 Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:1.9.0-2.el8cf |
libssh2-debuginfo Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:1.9.0-2.el8cf |
libssh2-debugsource Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:1.9.0-2.el8cf |
python3-ansible-runner Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:1.4.6-1.el8ar |
rubygem-actionpack-4_2 SUSE:OpenStack Cloud 7 | All versions | 4.2.9-7.9.1 |
rubygem-actionpack-4_2 SUSE:OpenStack Cloud Crowbar 8 | All versions | 4.2.9-7.9.1 |
rubygem-actionpack-4_2 SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.2.9-7.9.1 |
Products include Fedoraproject Fedora, Opensuse Leap, Rack Rack.
How do I fix CVE-2019-16782?
Upgrade rack to a fixed version for your release line: 1.6.12 or 2.0.8.
Is CVE-2019-16782 being exploited?
There is no known exploitation of CVE-2019-16782 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2019-16782, GHSA-hrqr-hxpp-chr3, RHSA-2020:2480, SUSE-SU-2021:1162-1, UBUNTU-CVE-2019-16782.