CVE-2018-1000119

rack-protection: Timing attack in authenticity_token.rb

View on CVE.org
Published Mar 7, 2018 CVSS 3.0 · 5.9 Medium EPSS 2.4% KEV · Not listed
Description
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-4247-1 ruby-rack-protection security update
EUVD EUVD EUVD-2018-0170 Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Github GHSA Github GHSA GHSA-688c-3x49-6rqj rack-protection gem timing attack vulnerability when validating CSRF token
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 5, 2024, 12:33 PM
Reserved
Mar 7, 2018, 12:00 AM

View source JSON

No data.

Status
Modified
Published
Mar 7, 2018, 2:29 PM
Modified
Jun 17, 2026, 1:32 AM

View source JSON

Severity
Moderate
Public date
May 25, 2015, 12:00 AM

View source Bugzilla JSON

No data.