PT-2019-14830 · Excon+1 · Excon+1
Geemus
·
Publicado
2019-12-16
·
Atualizado
2021-11-05
·
CVE-2019-16779
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
excon versions prior to 0.71.0
Description
The issue is related to a race condition around persistent connections in excon, where an interrupted connection, such as by a timeout, would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, making it difficult to purposefully exploit.
Recommendations
For versions prior to 0.71.0, upgrade to version 0.71.0 or a newer version if available.
As a temporary workaround, consider disabling persistent connections to minimize the risk of exploitation, though this may cause performance implications.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Excon