CVE-2019-16782

mediumPriorität · verfolgen · 25EPSS 0.037 · 90. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
3.70% (90th) EPSS
CVSS 4.3 · medium
Is it mine?
31 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · cert_bund · nvd

EPSS · bewertet 2026-10-22

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenansible-runner-0:1.4.6-1.el8ar.noarch as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenansible-runner-0:1.4.6-1.el8ar.src as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-amazon-smartstate-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-amazon-smartstate-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-appliance-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-appliance-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-appliance-common-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-appliance-tools-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-gemset-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobencfme-gemset-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenlibssh2-0:1.9.0-2.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenlibssh2-0:1.9.0-2.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenlibssh2-debuginfo-0:1.9.0-2.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenlibssh2-debugsource-0:1.9.0-2.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenpython3-ansible-runner-0:1.4.6-1.el8ar.noarch as a component of CloudForms Management Engine 5.11redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

    https://access.redhat.com/errata/RHSA-2020:2480
  • Behobenruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-0:3.1.18-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-0:3.1.18-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-0:3.1.18-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenruby4.0-rubygem-rack-0:3.1.18-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Workaroundansible-runner-0:1.4.6-1.el8ar.noarch as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundansible-runner-0:1.4.6-1.el8ar.src as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-amazon-smartstate-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-amazon-smartstate-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-appliance-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-appliance-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-appliance-common-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-appliance-tools-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-gemset-0:5.11.6.0-1.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundcfme-gemset-0:5.11.6.0-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundlibssh2-0:1.9.0-2.el8cf.src as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundlibssh2-0:1.9.0-2.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundlibssh2-debuginfo-0:1.9.0-2.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundlibssh2-debugsource-0:1.9.0-2.el8cf.x86_64 as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

  • Workaroundpython3-ansible-runner-0:1.4.6-1.el8ar.noarch as a component of CloudForms Management Engine 5.11redhat_csaf

    There is no mitigation for this issue, the flaw can only be resolved by applying updates.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 3.6
v3.16.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · ENISA EU
v3.16.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 1.8 · Auswirkung 4
v3.16.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · OSV
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.15.6mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · SUSE Product Security
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Red Hat Product Security US
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-203USprimärCWE-200USCWE-203USCWE-208USCWE-208US
04

betroffene Produkte (31)

Betroffene Produkte und Versionsbereiche.

20 von 31 angezeigt
05

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2020:2480Red Hat Security Advisory: CloudForms 5.0.6 security, bug fix and enhancement update2020-06-10csaf · redhat_csafUS

    An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2025-0383Ruby on Rails: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2019-12-18csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Ruby on Rails ausnutzen, um Informationen offenzulegen.

  • openSUSE-SU-2026:10286-1ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media2026-03-04csaf · suse_csafDE

    ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media

  • openSUSE-SU-2026:10358-1ruby4.0-rubygem-rack-3.1.18-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-rack-3.1.18-1.3 on GA media

  • GHSA-hrqr-hxpp-chr3Possible Information Leak / Session Hijack Vulnerability in Rack2019-12-18ghsa · osvUS

    There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison. ### Impact The session id stored in a cookie is the same id that is used when querying the backing session storage engine. Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id. By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session. ## Releases The 1.6.12 and 2.0.8 releases are available at the normal locations. ### Workarounds There are no known workarounds. ### Patches To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 1-6-session-timing-attack.patch - Patch for 1.6 series * 2-0-session-timing-attack.patch - Patch for 2.6 series ### Credits Thanks Will Leinweber for reporting this!

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcert_bundnvdosvredhat_csafsuse_csafNVDCVE.orgMITRE
veröffentlicht 2019-12-18geändert 2026-06-17
09

Referenzen (41)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan