Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubyUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-psychUpgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-minitest | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby22Upgrade ruby23Upgrade ruby20Upgrade ruby24 | May 11, 2018 | Mar 28, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-develUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubyUpgrade ruby-libsUpgrade rubygemsUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade ruby-debuginfo | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.8Upgrade jrubyUpgrade ruby1.9.1 | Aug 2, 2018 | Mar 28, 2018 |
| Freebsd | — | Upgrade ruby | Mar 30, 2018 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 3, 2020 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Nov 19, 2019 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 19, 2019 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubyUpgrade rubygems-develUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade ruby-doc | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubyNo solution existsUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade ruby-libsUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygems | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade yast2-ruby-bindingsUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-doc-riUpgrade ruby2.1-develUpgrade ruby2.5-develUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlib | Jul 22, 2019 | Mar 28, 2018 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.0Upgrade ruby1.9.3Upgrade libruby1.9.1Upgrade ruby2.3Upgrade ruby1.9.1Upgrade libruby2.0 | Jun 22, 2018 | Mar 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub