Posted by usa on 28 Mar 2018
There is an HTTP response splitting vulnerability in WEBrick bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-17742.
If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients.
All users running an affected release should upgrade immediately.
- Ruby 2.2 series: 2.2.9 and earlier
- Ruby 2.3 series: 2.3.6 and earlier
- Ruby 2.4 series: 2.4.3 and earlier
- Ruby 2.5 series: 2.5.0 and earlier
- Ruby 2.6 series: 2.6.0-preview1
- prior to trunk revision r62968
Thanks to Aaron Patterson firstname.lastname@example.org for reporting the issue.
- Originally published at 2018-03-28 14:00:00 (UTC)