Vulnerability CVE-2017-17742: Information

Description

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-17742
Published: April 4, 2018
Modified: May 1, 2023
Error type identifier: CWE-113

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
rubysisyphus2.5.1-alt13.1.4-alt4.4ALT-PU-2018-1522-1203208Fixed
rubyp102.5.1-alt13.1.4-alt2.p10.1ALT-PU-2018-1522-1203208Fixed
rubyp92.5.1-alt12.5.9-alt1ALT-PU-2018-1522-1203208Fixed
rubyp82.5.1-alt0.M80P.12.5.1-alt0.M80P.1ALT-PU-2018-1698-1203032Fixed
rubyc10f12.5.1-alt12.7.4-alt2.2.1ALT-PU-2018-1522-1203208Fixed
rubyc9f22.5.1-alt12.7.6-alt0.1.c9f2ALT-PU-2018-1522-1203208Fixed
rubyc72.4.4-alt0.M70C.12.4.4-alt0.M70C.1ALT-PU-2018-1813-1206923Fixed
rubyp112.5.1-alt13.1.4-alt4.4ALT-PU-2018-1522-1203208Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/
  • Patch
  • Release Notes
https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
  • Patch
  • Release Notes
https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
  • Patch
  • Release Notes
https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
  • Patch
  • Release Notes
https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/
  • Vendor Advisory
103684
  • Third Party Advisory
  • VDB Entry
[debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update
  • Third Party Advisory
[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update
  • Third Party Advisory
USN-3685-1
    [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
      DSA-4259
        1042004
          RHSA-2018:3731
            RHSA-2018:3730
              RHSA-2018:3729
                openSUSE-SU-2019:1771
                  RHSA-2019:2028
                    [debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update
                      [debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update
                        [debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update

                            1. Configuration 1

                              cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
                              Start including
                              2.3.0
                              End excliding
                              2.3.7
                              cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
                              Start including
                              2.4.0
                              End excliding
                              2.4.4
                              cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
                              Start including
                              2.5.0
                              End excliding
                              2.5.1
                              cpe:2.3:a:ruby-lang:ruby:2.6.0:preview1:*:*:*:*:*:*
                              cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
                              Start including
                              2.2.0
                              End excliding
                              2.2.10

                              Configuration 2

                              cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
                          VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                          Version: v24.5.3
                          Back to top