Published: 07/03/2018 Updated: 24/08/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and previous versions contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sinatrarb rack-protection 2.0.0
sinatrarb rack-protection

Synopsis Important: pcs security update Type/Severity Security Advisory: Important Topic An update for pcs is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which g ...

Debian Bug report logs - #892250 ruby-rack-protection: CVE-2018-1000119: Timing attack in authenticity_tokenrb Package: src:ruby-rack-protection; Maintainer for src:ruby-rack-protection is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debian ...

A timing attack was discovered in the function for CSRF token validation of the Ruby rack protection framework For the stable distribution (stretch), this problem has been fixed in version 153-2+deb9u1 We recommend that you upgrade your ruby-rack-protection packages For the detailed security status of ruby-rack-protection please refer to its s ...

Debug parameter removal bypass, allowing information disclosureIt was found that the REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information A remote attacker with a valid token could use this flaw to elevate their privilege (CVE-2018-1086) Timing attack ...

CWE-203 https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109 https://github.com/sinatra/rack-protection/pull/98 https://access.redhat.com/errata/RHSA-2018:1060 https://www.debian.org/security/2018/dsa-4247 https://access.redhat.com/errata/RHSA-2018:1060 https://nvd.nist.gov https://www.debian.org/security/./dsa-4247

CVE-2018-1000119

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect