huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2017-9461: samba: fd_open_atomic infinite loop due to wrong handling of dangling symlinks
Component: samba
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-02-16T00:00:00+00:00

A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory.


Affected upstream versions: n/a
Fixed upstream versions: tevent-0.9.32
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: 10c3e3923022485c720f322ca4f0aca5d7501310
CVE-2017-9462: mercurial: Python debugger accessible to authorized users
Component: mercurial
Severity: Important
CWE: CWE-284 (Improper Access Control)
CVSS v3: 6.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2017-04-18T00:00:00+00:00

A flaw was found in the way "hg serve --stdio" command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options.


Affected upstream versions: n/a
Upstream repository: https://www.mercurial-scm.org/repo/hg
Upstream fix commit: 77eaf9539499
CVE-2017-9798: httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
Component: httpd
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-09-18T00:00:00+00:00

A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash.

Statement: This issue affects the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6, and 7. This issue affects the versions of httpd24-httpd as shipped with Red Hat Software Collections. Product Security has rated this issue as having Moderate security impact.

In order to be vulnerable, .htaccess files need to contain an invalid or not globally registered HTTP method in a "Limit" directive.

Affected upstream versions: Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27
Fixed upstream versions: 2.5.0-alpha
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: 4cc27823899e070268b906ca677ee838d07cf67a
CVE-2018-0494: wget: Cookie injection allows malicious website to write arbitrary cookie entries into cookie jar
Component: wget
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)
Public date: 2018-05-06T00:00:00+00:00

A cookie injection flaw was found in wget. An attacker can create a malicious website which, when accessed, overrides cookies belonging to arbitrary domains.


Affected upstream versions: WGet
Upstream repository: https://git.savannah.gnu.org/cgit/wget.git
Upstream fix commit: 1fc9c95ec144499e69dc8ec76dbe07799d7d82cd
CVE-2018-0495: ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries
Component: ROHNP
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-06-13T00:00:00+00:00

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Statement: Since the 5.8.3 release, Red Hat CloudForms no longer uses libtomcrypt.

Affected upstream versions: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3
Upstream repository: https://git.gnupg.org/cgi-bin/libgcrypt.git
Upstream fix commit: 9010d1576e278a4274ad3f4aa15776c28f6ba965
CVE-2018-0500: curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP
Component: curl
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-07-11T00:00:00+00:00

A heap-based buffer overflow has been found in the Curl_smtp_escape_eob() function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory.

Statement: This issue did not affect the versions of curl/libcurl as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include the vulnerable code.

This issue did not affect the versions of curl/libcurl as shipped with Red Hat Software Collections 3 as they did not include the vulnerable code.

Affected upstream versions: curl before 7.61.0
Fixed upstream versions: curl-7_61_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b628
CVE-2018-0732: openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang
Component: openssl
Severity: Moderate
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-06-12T00:00:00+00:00

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).


Affected upstream versions: Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h), Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)
Fixed upstream versions: OpenSSL_1_0_2p
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 3984ef0b72831da8b3ece4745cac4f8575b19098
CVE-2018-0734: openssl: timing side channel attack in the DSA signature algorithm
Component: openssl
Severity: Low
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-10-16T00:00:00+00:00

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).


Affected upstream versions: Fixed in OpenSSL 1.1.1a (Affected 1.1.1), Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i), Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)
Fixed upstream versions: OpenSSL_1_1_1a
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 8abfe72e8c1de1b95f50aa0d9134803b4d00070f
CVE-2018-0735: openssl: timing side channel attack in the ECDSA signature generation
Component: openssl
Severity: Low
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-10-25T00:00:00+00:00

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).


Affected upstream versions: Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i), Fixed in OpenSSL 1.1.1a (Affected 1.1.1)
Fixed upstream versions: OpenSSL_1_1_0j
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 56fb454d281a023b3f950d969693553d3f3ceea1
CVE-2018-0737: openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys
Component: openssl
Severity: Low
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)
Public date: 2018-04-16T00:00:00+00:00

OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.


Affected upstream versions: Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h), Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)
Fixed upstream versions: OpenSSL_1_0_2p
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 349a41da1ad88ad87825414752a8ff5fdd6a6c3f
CVE-2018-0739: openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service
Component: openssl
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-03-27T00:00:00+00:00

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).


Affected upstream versions: Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g), Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)
Fixed upstream versions: OpenSSL_1_1_0h
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33
CVE-2018-1000073: rubygems: Path traversal when writing to a symlinked basedir outside of the root
Component: rubygems
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 1b931fc03b819b9a0214be3eaca844ef534175e2
CVE-2018-1000074: rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML
Component: rubygems
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
CVE-2018-1000075: rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service
Component: rubygems
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 92e98bf8f810bd812f919120d4832df51bc25d83
CVE-2018-1000076: rubygems: Improper verification of signatures in tarball allows to install mis-signed gem
Component: rubygems
Severity: Moderate
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: f5042b879259b1f1ce95a0c5082622c646376693
CVE-2018-1000077: rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL
Component: rubygems
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: feadefc2d351dcb95d6492f5ad17ebca546eb964
CVE-2018-1000078: rubygems: XSS vulnerability in homepage attribute when displayed via gem server
Component: rubygems
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 66a28b9275551384fdab45f3591a82d6b59952cb
CVE-2018-1000079: rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations
Component: rubygems
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-02-15T00:00:00+00:00

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

Statement: This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having a security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having a security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 666ef793cad42eed96f7aee1cdf77865db921099
CVE-2018-1000115: memcached: UDP server support allows spoofed traffic amplification DoS
Component: memcached
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-03-02T00:00:00+00:00

It was discovered that the memcached connections using UDP transport protocol can be abused for efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to send a significantly larger response to the target.

Statement: Red Hat is aware of traffic amplification distributed denial of service (DDoS) attacks that take advantage of the insecurely configured memcached servers reachable from the public Internet. The default configuration of memcached as shipped in Red Hat products makes it possible to abuse them for these DDoS attacks if memcached is exposed to connections from the public Internet. Refer to the Red Hat Knowledgebase article 3369081 for instructions on how to properly secure memcached installations to prevent them from being used in the attack.

https://access.redhat.com/solutions/3369081

Affected upstream versions: n/a
Fixed upstream versions: 1.5.6
Upstream repository: https://github.com/memcached/memcached
Upstream fix commit: dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
CVE-2018-1000119: rack-protection: Timing attack in authenticity_token.rb
Component: rack-protection
Severity: Moderate
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2015-05-25T00:00:00+00:00

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Statement: This issue affects the versions of rubygem-rack-protection as shipped with Red Hat Satellite 6. Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v2.0.0
Upstream repository: https://github.com/sinatra/sinatra
Upstream fix commit: 8aa6c42ef724f93ae309fb7c5668e19ad547eceb