[DRE-maint] Bug#946904: ruby-excon: CVE-2019-16779

[Salvatore Bonaccorso]

Source: ruby-excon
Version: 0.60.0-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for ruby-excon.

CVE-2019-16779[0]:
| In RubyGem excon before 0.71.0, there was a race condition around
| persistent connections, where a connection which is interrupted (such
| as by a timeout) would leave data on the socket. Subsequent requests
| would then read this data, returning content from the previous
| response. The race condition window appears to be short, and it would
| be difficult to purposefully exploit this.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-16779
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16779
[1] https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
[2] https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore