Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-mysql2-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade ruby-devel | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-io-console-debuginfoUpgrade ruby-libsUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade ruby-libs-debuginfoUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdoc | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Feb 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-opensslUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-json | Jul 2, 2021 | Oct 25, 2019 |
| Redhat_linux | — | Upgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debuginfoUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-power_assertUpgrade rubygem-bundler-docNo solution existsUpgrade rubygems-develUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygemsUpgrade rubygem-bundlerUpgrade ruby-devel | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-bson-debugsourceUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-doc-riUpgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlib | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade ruby2.5Upgrade libruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub