The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-rubyalpine-linux-upgrade-ruby2-2 | Aug 22, 2024 | Sep 19, 2017 | |
| Amazon_linux | — | amazon-linux-upgrade--ruby23amazon-linux-upgrade-ruby22amazon-linux-upgrade-ruby24 | Oct 3, 2017 | Sep 19, 2017 |
| Apple Osx Ruby | apple-osx-security-update-2018-002-high-sierraapple-osx-upgrade-latest | Oct 31, 2018 | Sep 19, 2017 | |
| Centos_linux | — | centos-upgrade-rubycentos-upgrade-ruby-debuginfocentos-upgrade-ruby-develcentos-upgrade-ruby-doccentos-upgrade-ruby-irbcentos-upgrade-ruby-libscentos-upgrade-ruby-tcltkcentos-upgrade-rubygem-bigdecimalcentos-upgrade-rubygem-io-consolecentos-upgrade-rubygem-jsoncentos-upgrade-rubygem-minitestcentos-upgrade-rubygem-psychcentos-upgrade-rubygem-rakecentos-upgrade-rubygem-rdoccentos-upgrade-rubygemscentos-upgrade-rubygems-devel | Mar 13, 2018 | Sep 19, 2017 |
| Debian | debian-upgrade-ruby1-8debian-upgrade-ruby1-9-1debian-upgrade-ruby2-3 | Dec 5, 2017 | Sep 19, 2017 | |
| Freebsd | freebsd-upgrade-package-ruby | Sep 19, 2017 | Sep 19, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-ruby | Oct 30, 2017 | Sep 19, 2017 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-rubyhuawei-euleros-2_0_sp1-upgrade-ruby-irbhuawei-euleros-2_0_sp1-upgrade-ruby-libs | Mar 16, 2018 | Sep 19, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-rubyhuawei-euleros-2_0_sp2-upgrade-ruby-irbhuawei-euleros-2_0_sp2-upgrade-ruby-libs | Mar 16, 2018 | Sep 19, 2017 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-ruby-23-2-3-8-11-4-6-0-1-1-0oracle-solaris-11-4-upgrade-runtime-ruby-23-ruby-tk-2-3-8-11-4-6-0-1-1-0 | Feb 20, 2019 | Sep 19, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-rubyoracle-linux-upgrade-ruby-develoracle-linux-upgrade-ruby-docoracle-linux-upgrade-rubygem-bigdecimaloracle-linux-upgrade-rubygem-io-consoleoracle-linux-upgrade-rubygem-jsonoracle-linux-upgrade-rubygem-minitestoracle-linux-upgrade-rubygem-psychoracle-linux-upgrade-rubygem-rakeoracle-linux-upgrade-rubygem-rdocoracle-linux-upgrade-rubygemsoracle-linux-upgrade-rubygems-develoracle-linux-upgrade-ruby-irboracle-linux-upgrade-ruby-libsoracle-linux-upgrade-ruby-tcltk | Mar 1, 2018 | Sep 14, 2017 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-rubyredhat-upgrade-ruby-debuginforedhat-upgrade-ruby-develredhat-upgrade-ruby-docredhat-upgrade-ruby-irbredhat-upgrade-ruby-libsredhat-upgrade-ruby-tcltkredhat-upgrade-rubygem-bigdecimalredhat-upgrade-rubygem-io-consoleredhat-upgrade-rubygem-jsonredhat-upgrade-rubygem-minitestredhat-upgrade-rubygem-psychredhat-upgrade-rubygem-rakeredhat-upgrade-rubygem-rdocredhat-upgrade-rubygemsredhat-upgrade-rubygems-devel | Mar 1, 2018 | Sep 19, 2017 | |
| Suse | — | suse-upgrade-libruby2_1-2_1suse-upgrade-ruby2-1suse-upgrade-ruby2-1-develsuse-upgrade-ruby2-1-stdlibsuse-upgrade-yast2-ruby-bindings | Jun 10, 2020 | Sep 19, 2017 |
| Ubuntu | ubuntu-upgrade-libruby1-9-1ubuntu-upgrade-libruby2-0ubuntu-upgrade-libruby2-3ubuntu-upgrade-ruby1-9-1ubuntu-upgrade-ruby1-9-3ubuntu-upgrade-ruby2-0ubuntu-upgrade-ruby2-3 | Oct 5, 2017 | Sep 19, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub