CVE-2019-16782: Possible Information Leak / Session Hijack Vulnerability in Rack
Vulnerability summary
CVE-2019-16782 is a medium (CVSS 6.3) Observable Timing Discrepancy vulnerability in fedoraproject fedora. EPSS estimates a 3.70% chance of exploitation in the next 30 days, higher than 89.7% of scored vulnerabilities.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 18 · Related 15Timeline
- 18-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
CVSS metrics
7 scores · 6 sources · 2 versions- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · RubygemsEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
3.70%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.70% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat11 products
- ansible-runner< 0:1.4.6-1.el8ar
- cfme< 0:5.11.6.0-1.el8cf
- cfme-amazon-smartstate< 0:5.11.6.0-1.el8cf
- cfme-appliance< 0:5.11.6.0-1.el8cf
- cfme-appliance-common< 0:5.11.6.0-1.el8cf
Suse3 products
- rubygem-actionpack-4_2&distro=SUSE OpenStack Cloud 7< 4.2.9-7.9.1
- rubygem-actionpack-4_2&distro=SUSE OpenStack Cloud Crowbar 8< 4.2.9-7.9.1
- rubygem-actionpack-4_2&distro=SUSE OpenStack Cloud Crowbar 9< 4.2.9-7.9.1
Debian1 product
- ruby-rack< 2.1.1-2
Fedoraproject1 product
- fedoraEOL31
Opensuse1 product
- leapEOL15.1
Rack1 product
- rack< 1.6.12 or 2.0.8 | < 1.6.12 | ≥ 2.0.0, < 2.0.8
RubyGems1 product
- rack< 1.6.12 | ≥ 2.0.0, < 2.0.8
Ubuntu1 product
- ruby-rack< 1.5.2-3+deb8u3ubuntu1~esm3 | < 1.6.4-3ubuntu0.2+esm1 | < 1.6.4-4ubuntu0.2+esm1 | < 2.0.7-2ubuntu0.1+esm1
8 vendors · 20 products
References
50 links- github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3X Refsource CONFIRMThird Party AdvisoryARTICLEREPORTWEB
- github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38X Refsource CONFIRMPatchThird Party AdvisoryREPORTWEB
- www.openwall.com/lists/oss-security/2019/12/18/3Mailing ListX Refsource MLISTThird Party AdvisoryREPORTWEB
- www.openwall.com/lists/oss-security/2019/12/18/2Mailing ListX Refsource MLISTThird Party AdvisoryREPORTWEB
- www.openwall.com/lists/oss-security/2019/12/19/3Mailing ListX Refsource MLISTThird Party AdvisoryREPORTWEB
- lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2020/04/08/1Mailing ListX Refsource MLISTPatchThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2020/04/09/2Mailing ListX Refsource MLISTThird Party AdvisoryWEB
Show all 50 references
- github.com/rack/rackPACKAGE