Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-pg | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-develUpgrade ruby-tcltkUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-irb | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-json-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubygem-io-console-debuginfoUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade ruby-libs-debuginfoUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-json | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Feb 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-irbUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-opensslUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-doc | Jul 2, 2021 | Oct 25, 2019 |
| Redhat_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docNo solution existsUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-mongoUpgrade rubygem-xmlrpcUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-irbUpgrade ruby-debugsourceUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debugsource | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade ruby-develUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2-debugsource | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade yast2-ruby-bindingsUpgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5-doc | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.5Upgrade libruby2.3Upgrade ruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub