CVE-2018-1000119

NONE EPSS 82.7%
Published Mar 7, 20188y ago · Modified Jun 17, 20262w ago
Find Similar
Published Mar 7, 2018 8y ago
Last Modified Jun 17, 2026 2w ago

Description

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Threat Intelligence

EPSS Exploit Probability
82.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-203

Affected Products 4

VendorProductVersionRange
sinatrarbrack-protection* <1.5.5
sinatrarbrack-protection2.0.0any
sinatrarbrack-protection2.0.0any
sinatrarbrack-protection2.0.0any

References 4

  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1060
    Third Party Advisory
  • github.com https://github.com/sinatra/rack-protection/pull/98
    Issue TrackingThird Party Advisory
  • github.com https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109
    Issue TrackingPatchThird Party Advisory
  • debian.org https://www.debian.org/security/2018/dsa-4247

Remediation

  • github.com https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109
    Issue TrackingPatchThird Party Advisory