Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubyUpgrade ruby-docUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-io-console | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby20Upgrade ruby24Upgrade ruby23Upgrade ruby22 | May 11, 2018 | Mar 28, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-tcltkUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubyUpgrade rubygemsUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-io-console | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.8Upgrade jrubyUpgrade ruby1.9.1 | Aug 2, 2018 | Mar 28, 2018 |
| Freebsd | — | Upgrade ruby | Mar 30, 2018 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Nov 3, 2020 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 19, 2019 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 19, 2019 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygems-develUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade ruby | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | No solution existsUpgrade ruby-irbUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygemsUpgrade rubygems-devel | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.5-develUpgrade libruby2_1-2_1Upgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.1-develUpgrade ruby2.5-devel-extraUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.1Upgrade yast2-ruby-bindings | Jul 22, 2019 | Mar 28, 2018 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby1.9.1Upgrade ruby1.9.3Upgrade ruby2.3Upgrade ruby2.0Upgrade ruby1.9.1Upgrade libruby2.0 | Jun 22, 2018 | Mar 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub