Information Exposure Through Timing Discrepancy in Rack - CVE-2019-16782

Vulnerability identifier: #VU23688

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-16782

CWE-ID: CWE-208

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a hijack victim's session.

The vulnerability exists due to an indexing issue in Rack (RubyGem rack) when processing user sessions. A remote attacker can guess session identifier and hijack victim's session.

Rack
Ruby on Rails
SUSE OpenStack Cloud
Fedora
SUSE OpenStack Cloud Crowbar
Opensuse
rubygem-rack
ruby2.1-rubygem-actionpack-4_2
IBM Watson Discovery for IBM Cloud Pak for Data

Install updates from vendor's website.

Rack - addressed in versions 1.6.12, 2.0.8
Ruby on Rails - addressed in versions 5.2.4.1, 6.0.2.1
rubygem-rack - addressed in versions 1.6.12-1.el7, 2.0.8-1.el8, 2.0.8-1.fc31
ruby2.1-rubygem-actionpack-4_2 - update to 4.2.9-7.9.1
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0

• https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38
• https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3

• Session hijacking in RubyGems Rack
• Session hijackign in Ruby on Rails
• OpenSUSE Linux update for rubygem-rack
• SUSE update for rubygem-actionpack-4_2
• Multiple vulnerabilities in IBM Watson Discovery
• Fedora EPEL 8 update for rubygem-rack
• Fedora 31 update for rubygem-rack
• Fedora EPEL 7 update for rubygem-rack