CVE-2017-17742: HTTP response splitting in WEBrick

Posted by usa on 28 Mar 2018

There is an HTTP response splitting vulnerability in WEBrick bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-17742.

Details

If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients.

All users running an affected release should upgrade immediately.

Affected Versions

  • Ruby 2.2 series: 2.2.9 and earlier
  • Ruby 2.3 series: 2.3.6 and earlier
  • Ruby 2.4 series: 2.4.3 and earlier
  • Ruby 2.5 series: 2.5.0 and earlier
  • Ruby 2.6 series: 2.6.0-preview1
  • prior to trunk revision r62968

Credit

Thanks to Aaron Patterson tenderlove@ruby-lang.org for reporting the issue.

History

  • Originally published at 2018-03-28 14:00:00 (UTC)