Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-pg-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-did_you_meanUpgrade rubygem-openssl | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-pg-debugsourceUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-xmlrpcUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimal | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Feb 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubyUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-bigdecimal | Jul 2, 2021 | Oct 25, 2019 |
| Redhat_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygems-develNo solution existsUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debuginfoUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-abrt-doc | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade ruby-libs-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1Upgrade yast2-ruby-bindingsUpgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade libruby2_5-2_5 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub