Bug 1789100 (CVE-2019-16782)

Summary:	CVE-2019-16782 rubygem-rack: hijack sessions by using timing attacks targeting the session id
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbuckingham, bcourt, bkearney, bmidwood, btotty, dbecker, dmetzger, gblomqui, gmccullo, gp, gtanzill, hhorak, hhudgeon, hvyas, jaruga, jfrey, jhardy, jjoyce, jorton, jschluet, kbasil, kdixon, lavenel, lhh, lpeer, lzap, mburns, mmccune, mo, obarenbo, puebele, rchan, rhos-maint, rjerrido, roliveri, ruby-maint, ruby-packagers-sig, sclewis, simaishi, sisharma, slinaber, smallamp, sokeeffe, steve.traylen, strzibny, vbellur, vondruch, ytale
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Rack 1.6.12, Rack 2.0.8	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-10 17:20:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1789101, 1789102, 1789103, 1790305, 1790340, 1790341, 1790342, 1790343, 1790344, 1790345, 1790346, 1790347, 1790348, 1793968, 1797947, 1797948, 1797949, 1797950, 1797951, 1797952, 1797953, 1797954, 1797955, 1804332, 1825820, 1825821
Bug Blocks:	1789104

Description Guilherme de Almeida Suckevicz 2020-01-08 18:14:53 UTC

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Reference:
https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3

Upstream commit:
https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38

Comment 1 Guilherme de Almeida Suckevicz 2020-01-08 18:15:32 UTC

Created rubygem-rack tracking bugs for this issue:

Affects: epel-6 [bug 1789102]
Affects: epel-7 [bug 1789103]
Affects: fedora-all [bug 1789101]

Comment 2 Summer Long 2020-01-13 04:07:05 UTC

Mitigation:

There is no mitigation for this issue, the flaw can only be resolved by applying updates.

Comment 12 Marco Benatto 2020-02-18 17:26:18 UTC

External References:

https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3

Comment 15 errata-xmlrpc 2020-06-10 13:39:05 UTC

This issue has been addressed in the following products:

  CloudForms Management Engine 5.11

Via RHSA-2020:2480 https://access.redhat.com/errata/RHSA-2020:2480

Comment 16 Product Security DevOps Team 2020-06-10 17:20:27 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-16782

Comment 17 Eric Christensen 2020-08-24 16:09:33 UTC

Statement:

Because Red Hat OpenStack Platform 13.0 Operational Tools packaged the flawed code, but does not use its functionality, its Impact has been reduced to 'Low'.