CVE-2019-16779

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted such as by a timeout would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition...

CVE-2019-16779

In CVE-2019-16779, RubyGem excon before 0.71.0 contains a race condition on persistent connections where an interrupted connection can leave data on the socket, causing subsequent requests to return content from the previous response. This affects ruby-excon packages across multiple distributions...

GHSA-Q58G-455P-8VW9 In RubyGem excon, interrupted Persistent Connections May Leak Response Data

Impact There was a race condition around persistent connections, where a connection which is interrupted such as by a timeout would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short,...

In RubyGem excon, interrupted Persistent Connections May Leak Response Data

Impact There was a race condition around persistent connections, where a connection which is interrupted such as by a timeout would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short,...

Insecure Cipher Suites

excon uses insecure SSL cipher suites. The usage of insecure 3DES ciphers enables a remote attacker to carry out man-in-the-middle attacks...

HTTP Header Injection

excon is vulnerable to HTTP Header Injection through header splitting. The vulnerability exists as special newline characters such as \r\n could be used to split the HTTP header, allowing HTTP Header Injection attacks...

Man-In-The-Middle (MitM)

excon is vulnerable to man-in-the-middle MitM attacks. The rubygems source is deprecated because HTTP requests are insecure. A malicious user can potentially compromise the source to conduct MitM attacks...

HTTP Header Injection

excon is vulnerable to HTTP header injection vulnerability. It does not properly parse the path, allowing attackers to inject arbitrary headers in requests or even create a new evil request...