{"action":"Upgrade rack-protection to 1.5.5 or later.","affected":[{"fixed":"1.5.5","introduced":"0"},{"fixed":"2.0.0","introduced":"2.0.0.beta1"}],"component":"rack-protection","cve_ids":["CVE-2018-1000119"],"ecosystem":"RubyGems","epss":0.02404,"exploited":false,"fixed_versions":["1.5.5","2.0.0"],"ghsa_id":"GHSA-688c-3x49-6rqj","id":"tcs_01M5KEH8JX0Z6340FHFAEK6628","modified_at":"2024-02-16T07:58:58.375721Z","published_at":"2018-03-07T22:22:22Z","references":["https://osv.dev/vulnerability/GHSA-688c-3x49-6rqj","https://nvd.nist.gov/vuln/detail/CVE-2018-1000119","https://github.com/sinatra/rack-protection/pull/98","https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109","https://access.redhat.com/errata/RHSA-2018:1060","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-protection/CVE-2018-1000119.yml","https://github.com/sinatra/rack-protection","https://www.debian.org/security/2018/dsa-4247"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-688c-3x49-6rqj","url":"https://osv.dev/vulnerability/GHSA-688c-3x49-6rqj"}],"summary":"rack-protection gem timing attack vulnerability when validating CSRF token"}