CVE - CVE-2019-16782

CVE-ID
CVE-2019-16782	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38 CONFIRM:https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3 FEDORA:FEDORA-2020-57fc0d0156 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX/ MLIST:[oss-security] 20191218 Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack URL:http://www.openwall.com/lists/oss-security/2019/12/19/3 MLIST:[oss-security] 20191218 [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack URL:http://www.openwall.com/lists/oss-security/2019/12/18/2 MLIST:[oss-security] 20191219 Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack URL:http://www.openwall.com/lists/oss-security/2019/12/18/3 MLIST:[oss-security] 20200408 Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack URL:http://www.openwall.com/lists/oss-security/2020/04/09/2 MLIST:[oss-security] 20200409 Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack URL:http://www.openwall.com/lists/oss-security/2020/04/08/1 SUSE:openSUSE-SU-2020:0214 URL:http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20190924	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20190924)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)