CVE-2018-1000119
1 advisory.
RubyGems/rack-protection CVE-2018-1000119: medium 5.9, EPSS 2.40%
rack-protection gem timing attack vulnerability when validating CSRF token
Action: Upgrade rack-protection to 1.5.5 or later.
bundle update rack-protectionAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.5 | - |
| 2.0.0.beta1 | 2.0.0 | - |
Fixed versions
| 1.5.5 | 2.0.0 |
Sources
- osv: GHSA-688c-3x49-6rqj
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000119
- https://github.com/sinatra/rack-protection/pull/98
- https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109
- https://access.redhat.com/errata/RHSA-2018:1060
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-protection/CVE-2018-1000119.yml
- https://github.com/sinatra/rack-protection
- https://www.debian.org/security/2018/dsa-4247
CVE-2018-1000119 · published · modified · JSON