Posted by mame on 29 Sep 2020
A potential HTTP request smuggling vulnerability in WEBrick was reported. This vulnerability has been assigned the CVE idenfitifer CVE-2020-25613. We strongly recommend upgrading the webrick gem.
WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request. See CWE-444 in detail.
Please update the webrick gem to version 1.6.1 or later. You can use
gem update webrick to update it. If you are using bundler, please add
gem "webrick", ">= 1.6.1" to your
- webrick gem 1.6.0 or prior
- bundled versions of webrick in ruby 2.7.1 or prior
- bundled versions of webrick in ruby 2.6.6 or prior
- bundled versions of webrick in ruby 2.5.8 or prior
Thanks to piao for discovering this issue.
- Originally published at 2020-09-29 06:30:00 (UTC)