Skip to content
Fencer Intel
medium 5.9

CVE-2018-1000119 json

rack-protection gem timing attack vulnerability when validating CSRF token

published 8y ago modified 4mo ago also GHSA-688c-3x49-6rqj , EUVD-2018-0170

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Patch / fix

  • rubygems rack-protection 1.5.5, 2.0.0
  • sinatrarb rack-protection 1.5.5
  • ruby-rack-protection Ubuntu 16.04 LTS 1.5.3-2+deb9u1build0.16.04.1
  • ruby-rack-protection Ubuntu 18.04 LTS 1.5.3-2+deb9u1build0.18.04.1

ubuntu advisories UBUNTU-CVE-2018-1000119

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tfm satellite capsule 6.9, satellite 6.9 6.1-4.el7sat
  • kobo satellite capsule 6.9, satellite capsule 6.8, satellite 6.9 +1 more 0.5.1-1.el7sat
  • pulp satellite capsule 6.9, satellite 6.9 2.21.5-2.el7sat
  • gofer satellite capsule 6.9, satellite capsule 6.8, satellite 6.9 +1 more 2.12.5-7.el7sat
  • future satellite capsule 6.9, satellite capsule 6.8, satellite 6.9 +1 more 0.16.0-11.el7sat
  • ostree satellite capsule 6.9, satellite capsule 6.8, satellite 6.9 +1 more 2017.1-2.atomic.el7
  • foreman satellite capsule 6.9, satellite 6.9 2.3.1.20-1.el7sat
  • katello satellite capsule 6.9, satellite 6.9 3.18.1-3.el7sat

red hat advisories RHSA-2021:1313RHSA-2020:4366RHSA-2018:1060

Is CVE-2018-1000119 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000119 updated cvss 3.7

rack-protection: Timing attack in authenticity_token.rb

  • Red Hat Ceph Storage 1.3 rubygem-rack-protection Red Hat Enterprise Linux 6 pcs Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools rubygem-rack-protection Red Hat OpenStack Platform 8 (Liberty) Operational Tools rubygem-rack-protection Red Hat OpenStack Platform 9 (Mitaka) Operational Tools rubygem-rack-protection Red Hat OpenStack Platform 10 (Newton) Operational Tools rubygem-rack-protection
    +5 more products
    Red Hat OpenStack Platform 11 (Ocata) Operational Tools rubygem-rack-protection Red Hat OpenStack Platform 12 (Pike) Operational Tools rubygem-rack-protection Red Hat OpenStack Platform 13 (Queens) Operational Tools rubygem-rack-protection Red Hat Software Collections rh-ror41-rubygem-rack-protection, rh-ror42-rubygem-rack-protection, rh-ror50-rubygem-rack-protection Red Hat Storage 3 pcs, rubygem-rack-protection
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Server High Availability (v. 7) pcs 0.9.162-5.el7_5.1, pcs-snmp 0.9.162-5.el7_5.1 Red Hat Enterprise Linux Server Resilient Storage (v. 7) pcs 0.9.162-5.el7_5.1, pcs-snmp 0.9.162-5.el7_5.1
    fixed: vendor fix RHSA-2018:1060
  • Red Hat Satellite 6.8 tfm 6.1-1.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.3-1.el7sat, gofer 2.12.5-7.el7sat, receptor 0.6.3-1.el7ar, future 0.16.0-11.el7sat, +488 more
    fixed: vendor fix RHSA-2020:4366
  • Red Hat Satellite 6.9 tfm 6.1-4.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.5-2.el7sat, gofer 2.12.5-7.el7sat, libsolv 0.7.12-2.el7pc, receptor 0.6.3-1.el7ar, +639 more
    fixed: vendor fix RHSA-2021:1313
  • Red Hat Satellite Capsule 6.8 tfm 6.1-1.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.3-1.el7sat, gofer 2.12.5-7.el7sat, future 0.16.0-11.el7sat, katello 3.16.0-1.el7sat, +232 more
    fixed: vendor fix RHSA-2020:4366
  • Red Hat Satellite Capsule 6.9 tfm 6.1-4.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.5-2.el7sat, gofer 2.12.5-7.el7sat, libsolv 0.7.12-2.el7pc, future 0.16.0-11.el7sat, +238 more
    fixed: vendor fix RHSA-2021:1313
  • Red Hat Enterprise Linux 8 rubygem-rack-protection Red Hat Satellite 6 tfm-ror52-rubygem-rack-protection
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.40% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems rack-protection
<1.5.5
>=2.0.0.beta1, <2.0.0
1.5.5
2.0.0

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.