Source: ruby-excon Version: 0.60.0-1 Severity: important Tags: security upstream
Hi, The following vulnerability was published for ruby-excon. CVE-2019-16779[0]: | In RubyGem excon before 0.71.0, there was a race condition around | persistent connections, where a connection which is interrupted (such | as by a timeout) would leave data on the socket. Subsequent requests | would then read this data, returning content from the previous | response. The race condition window appears to be short, and it would | be difficult to purposefully exploit this. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2019-16779 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16779 [1] https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 [2] https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
