CVE-2018-1000119

Name of the Vulnerable Software and Affected Versions Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier

Description The issue is related to a timing attack vulnerability in the CSRF token checking mechanism. This vulnerability can result in signatures being exposed and appears to be exploitable via network connectivity to the Ruby application. The vulnerability is associated with errors in the CSRF token checking procedure, which can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 1.5.4 and earlier, update to version 1.5.5. For version 2.0.0.rc3 and earlier, update to version 2.0.0.