PT-2018-3121 · Ruby+6 · Ruby+6

Aaron Patterson · Published 2018-03-28 · Updated 2023-05-01 · CVE-2017-17742

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.2.10 Ruby versions 2.3.x prior to 2.3.7 Ruby versions 2.4.x prior to 2.4.4 Ruby versions 2.5.x prior to 2.5.1 Ruby version 2.6.0-preview1

Description The issue is related to the WEBrick library in the Ruby programming language, specifically concerning the handling of CRLF sequences in HTTP headers. This can allow an attacker to inject crafted HTTP headers, potentially leading to an HTTP Response Splitting attack. An attacker can exploit this by injecting a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Recommendations For Ruby versions prior to 2.2.10, update to version 2.2.10 or later. For Ruby versions 2.3.x prior to 2.3.7, update to version 2.3.7 or later. For Ruby versions 2.4.x prior to 2.4.4, update to version 2.4.4 or later. For Ruby versions 2.5.x prior to 2.5.1, update to version 2.5.1 or later. For Ruby version 2.6.0-preview1, update to a later version.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

ALT-PU-2018-1522

BDU:2019-04156

CESA-2019_2028

CVE-2017-17742

DLA-1358-1

DLA-1359-1

DLA-1421-1

DLA-2007-1

DLA-2027-1

DLA-2330-1

DLA-3408-1

DSA-4259-1

MGASA-2018-0411

MGASA-2020-0440

OPENSUSE-SU-2019:1771-1

OPENSUSE-SU-2019_1771-1

RHSA-2018:3729

RHSA-2018:3730

RHSA-2018:3731

RHSA-2019:2028

RHSA-2019_2028

RHSA-2020:1963

RHSA-2020:2212

RHSA-2020:2288

SUSE-SU-2019:1804-1

SUSE-SU-2019_1804-1

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3685-1

Affected Products

Alt Linux

Astra Linux

Centos

Red Hat

Ruby

Suse

Ubuntu

References · 353

• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• https://safe-surf.ru/specialists/bulletins-nkcki/692292 · Security Note
• https://bdu.fstec.ru/vul/2019-04183 · Security Note
• https://bdu.fstec.ru/vul/2018-01595 · Security Note
• https://usn.ubuntu.com/3685-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8778 · Security Note
• https://osv.dev/vulnerability/DLA-3408-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03218 · Security Note
• https://ubuntu.com/security/CVE-2018-1000074 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17742 · Vendor Advisory
• https://ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released · Patch
• https://ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released · Patch
• https://ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17742 · Vendor Advisory