CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

• CWE-203

• https://access.redhat.com/errata/RHSA-2018:1060Third Party Advisory
• https://github.com/sinatra/rack-protection/pull/98Issue Tracking, Third Party Advisory
• https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109Issue Tracking, Patch, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4247
• https://access.redhat.com/errata/RHSA-2018:1060Third Party Advisory
• https://github.com/sinatra/rack-protection/pull/98Issue Tracking, Third Party Advisory
• https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109Issue Tracking, Patch, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4247

Published

Mar 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000113A cross-site scripting vulnerability exists in Jenkins TestL…
• CVE-2018-1000114An improper authorization vulnerability exists in Jenkins Pr…
• CVE-2018-1000115Memcached version 1.5.5 contains an Insufficient Control of …
• CVE-2018-1000116NET-SNMP version 5.7.2 contains a heap corruption vulnerabil…
• CVE-2018-1000117Python Software Foundation CPython version From 3.2 until 3.…6.7
• CVE-2018-1000118Github Electron version Electron 1.8.2-beta.4 and earlier co…
• CVE-2018-1000120A buffer overflow exists in curl 7.12.3 to and including cur…
• CVE-2018-1000121A NULL pointer dereference exists in curl 7.21.0 to and incl…
• CVE-2018-1000122A buffer over-read exists in curl 7.20.0 to and including cu…
• CVE-2018-1000123Ionic Team Cordova plugin iOS Keychain version before commit…
• CVE-2018-1000124I Librarian I-librarian version 4.8 and earlier contains a X…10
• CVE-2018-1000125inversoft prime-jwt version prior to version 1.3.0 or prior …