PT-2018-3275 · Ruby+5 · Webrick+6

Eric Wong · Published 2018-03-28 · Updated 2020-06-09 · CVE-2018-8777

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.2.10 Ruby versions 2.3.x prior to 2.3.7 Ruby versions 2.4.x prior to 2.4.4 Ruby versions 2.5.x prior to 2.5.1 Ruby version 2.6.0-preview1

Description The issue is related to uncontrolled resource consumption in the WEBrick library of the Ruby programming language. An attacker can exploit this by sending a large HTTP request with a crafted header to the WEBrick server or a crafted body to the WEBrick server/handler, causing a denial of service due to memory consumption.

Recommendations For Ruby versions prior to 2.2.10, update to version 2.2.10 or later. For Ruby versions 2.3.x prior to 2.3.7, update to version 2.3.7 or later. For Ruby versions 2.4.x prior to 2.4.4, update to version 2.4.4 or later. For Ruby versions 2.5.x prior to 2.5.1, update to version 2.5.1 or later. For Ruby version 2.6.0-preview1, update to a later version.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2018-1522

BDU:2019-04471

CESA-2019_2028

CVE-2018-8777

DLA-1358-1

DLA-1359-1

DLA-1421-1

DSA-4259-1

MGASA-2018-0411

OPENSUSE-SU-2019:1771-1

OPENSUSE-SU-2019_1771-1

RHSA-2018:3729

RHSA-2018:3730

RHSA-2018:3731

RHSA-2019:2028

RHSA-2019_2028

RHSA-2020:0542

RHSA-2020:0591

RHSA-2020:0663

SUSE-SU-2019:1804-1

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3685-1

Affected Products

Alt Linux

Centos

Red Hat

Ruby

Suse

Ubuntu

Webrick

References · 300

• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• https://bdu.fstec.ru/vul/2019-04473 · Security Note
• https://ubuntu.com/security/CVE-2017-0902 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-8777 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2028 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17405 · Security Note
• https://bdu.fstec.ru/vul/2017-02342 · Security Note
• https://bdu.fstec.ru/vul/2020-00760 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/685432 · Security Note
• https://osv.dev/vulnerability/USN-3685-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000078 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8777 · Security Note
• https://advisories.mageia.org/MGASA-2018-0411.html · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/682552 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1421-1 · Vendor Advisory