Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-jsonUpgrade ruby-develUpgrade rubyUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygems-devel | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby20Upgrade ruby23Upgrade ruby22 | May 11, 2018 | Mar 28, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply OS X security update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-irbUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygems-devel | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade jrubyUpgrade ruby1.8 | Aug 2, 2018 | Mar 28, 2018 |
| Freebsd | — | Upgrade ruby | Mar 30, 2018 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 3, 2020 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 19, 2019 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Nov 19, 2019 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygemsUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-rdoc | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade ruby-irbNo solution existsUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-devel | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.1Upgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby-bundled-gems-rpmhelperUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-ri | Jul 22, 2019 | Mar 28, 2018 |
| Ubuntu | — | Upgrade ruby1.9.3Upgrade libruby1.9.1Upgrade libruby2.3Upgrade ruby2.0Upgrade ruby2.3Upgrade libruby2.0Upgrade ruby1.9.1 | Jun 22, 2018 | Mar 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub