CVE-2018-1000119

Published March 7th, 2018

View on NVD ↗

CVSS v3

N/A

CVSS v2

4.3

MEDIUM

Affected

PROJECTS

Description

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

sinatra/sinatra

Classy web-development dressed in a DSL (official / canonical repo)

GitHub

12.4K

sinatra/rack-protection

NOTE: This project has been merged upstream to sinatra/sinatra

GitHub

813