Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-16779

CVE-2019-16779:
In RubyGem excon, interrupted Persistent Connections May Leak Response Data

5.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-16779
GHSA ID
GHSA-q58g-455p-8vw9
EPSS Score
0.67135%
CWE
CWE-362
Published
12/16/2019
Updated
5/4/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
exconrubygems< 0.71.00.71.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of persistent connections in the request method. The patch adds: 1) A check for @persistent_socket_reusable flag before reusing connections, 2) A forced reset when detecting unreusable sockets, and 3) State management around response processing. The original code lacked these safeguards, making the request method's persistent connection reuse logic vulnerable to data leakage via socket contamination between requests. The direct modification of this method in the patch confirms its role in the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T**r* w*s * r*** *on*ition *roun* p*rsist*nt *onn**tions, w**r* * *onn**tion w*i** is int*rrupt** (su** *s *y * tim*out) woul* l**v* **t* on t** so*k*t. Su*s*qu*nt r*qu*sts woul* t**n r*** t*is **t*, r*turnin* *ont*nt *rom t** pr*vious r*s

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* p*rsist*nt *onn**tions in t** r*qu*st m*t*o*. T** p*t** ***s: *) * ****k *or @p*rsist*nt_so*k*t_r*us**l* *l** ***or* r*usin* *onn**tions, *) * *or*** r*s*t w**n **t**tin* unr*us**l* so*k*ts, *n* *) St