|Description||Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||medium (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|stretch (security), stretch||1.5.3-2+deb9u1||fixed|
The information below is based on the following data on fixed versions.
[jessie] - ruby-rack-protection <ignored> (Low prio package and low prio vulnerability according to RedHat)
[wheezy] - ruby-rack-protection <ignored> (Low prio package and low prio vulnerability according to RedHat)