An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2 | May 4, 2022 | Oct 6, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Oct 6, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygemsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-libs | May 26, 2021 | Oct 6, 2020 |
| Amazon_linux | — | Upgrade ruby20Upgrade ruby24 | Dec 19, 2020 | Oct 6, 2020 |
| Centos_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-psych-debuginfoUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-openssl-debuginfoUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-bson-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade ruby-docUpgrade rubyUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade ruby-default-gemsUpgrade rubygem-bson-debuginfo | Jun 30, 2021 | Oct 6, 2020 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Oct 5, 2020 | Oct 5, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Feb 22, 2021 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 20, 2021 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Feb 3, 2021 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 3, 2020 | Oct 6, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby | Nov 3, 2020 | Oct 6, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.28.0.1.82.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.28.0.1.82.1 on Solaris 11.4 | Jan 19, 2021 | Oct 6, 2020 |
| Oracle_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-psych | Jul 2, 2021 | Sep 29, 2020 |
| Redhat_linux | — | Upgrade rubygems-develUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-test-unitNo solution existsUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-irbUpgrade ruby-debugsourceUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson | Jun 30, 2021 | Oct 6, 2020 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-io-consoleUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-opensslUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimal | May 5, 2022 | Oct 6, 2020 |
| Suse | — | Upgrade ruby2.1-develUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.1-stdlib | Mar 25, 2021 | Oct 6, 2020 |
| Ubuntu | — | Upgrade libruby2.7Upgrade ruby2.5Upgrade libruby2.5Upgrade ruby2.7Upgrade libruby2.3Upgrade ruby2.3 | Mar 19, 2021 | Oct 6, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub