CVE-2017-17742 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Severity

50%

Complexity

99%

Confidentiality

48%

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

CVSS 3.0 Base Score 5.3. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N).

Demo Examples

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Overview

First reported 6 years ago

2018-04-03 22:29:00

Last updated 6 years ago

2018-11-30 11:29:00

Affected Software

Ruby-lang Ruby

Ruby-lang Ruby 2.6.0 Preview 1

2.6.0

Debian Linux 7.0

7.0

References

openSUSE-SU-2019:1771

103684

Third Party Advisory, VDB Entry

1042004

RHSA-2018:3729

RHSA-2018:3730

RHSA-2018:3731

RHSA-2019:2028

[debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update

Third Party Advisory

[debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update

Third Party Advisory

[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update

[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update

USN-3685-1

DSA-4259

https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/

Vendor Advisory

https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/

Patch, Release Notes

https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/

Patch, Release Notes

https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/

Patch, Release Notes

https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/

Patch, Release Notes

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.