In RubyGem excon, interrupted Persistent Connections May Leak Response Data

TRUNG BÌNH 5.9CVE-2019-16779 · GHSA-q58g-455p-8vw9 · Công bố 16/12/2019 · cập nhật 28/07/2026

Tóm tắt nhanh

CVE-2019-16779 là lỗ hổng mức TRUNG BÌNH (CVSS 5.9) ảnh hưởng excon, excon (excon project), backports sle (opensuse).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.7%, cao hơn 76.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.71.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
excon RubyGems	`< 0.71.0`	`0.71.0`
excon excon_project	`< 0.71.0`	`0.71.0`
backports sle opensuse	`= 15.0`	Chưa có bản vá

Mô tả

Impact

There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

Patches

The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists).

Workarounds

Users can workaround the problem by disabling persistent connections, though this may cause performance implications.

References

See the patch for further details.

For more information

If you have any questions or comments about this advisory:

Open an issue in excon/issues
Email us at [email protected]

Mô tả của NVD

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.