An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-abrt | May 4, 2022 | Oct 6, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Oct 6, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubyUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygem-irbUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade ruby-devel | May 26, 2021 | Oct 6, 2020 |
| Amazon_linux | — | Upgrade ruby20Upgrade ruby24 | Dec 19, 2020 | Oct 6, 2020 |
| Centos_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-opensslUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-minitestUpgrade ruby-libs-debuginfoUpgrade rubygemsUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-power_assertUpgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debugsource | Jun 30, 2021 | Oct 6, 2020 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Oct 5, 2020 | Oct 5, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Feb 22, 2021 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jan 20, 2021 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Feb 3, 2021 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Nov 3, 2020 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-irb | Nov 3, 2020 | Oct 6, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.28.0.1.82.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.28.0.1.82.1 on Solaris 11.4 | Jan 19, 2021 | Oct 6, 2020 |
| Oracle_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-did_you_mean | Jul 2, 2021 | Sep 29, 2020 |
| Redhat_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-psychUpgrade rubygem-bson-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade ruby-debugsourceUpgrade rubygem-bsonNo solution existsUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade ruby-docUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfo | Jun 30, 2021 | Oct 6, 2020 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bigdecimal | May 5, 2022 | Oct 6, 2020 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.1-develUpgrade libruby2_1-2_1Upgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.1Upgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-devel | Mar 25, 2021 | Oct 6, 2020 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.5Upgrade ruby2.5Upgrade libruby2.3Upgrade ruby2.7Upgrade ruby2.3 | Mar 19, 2021 | Oct 6, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub