NetSight
IP …
medium5.3

CVE-2017-17742

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack.

Impact

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Affected products

VendorProductAffected versions
Ruby-LangRuby
from 2.2.0 before 2.2.10
from 2.3.0 before 2.3.7
from 2.4.0 before 2.4.4
from 2.5.0 before 2.5.1
Version 2.6.0
DebianDebian Linux
Version 7.0

Weakness classification

CWE-113

References