NetSight
IP …
high7.5

CVE-2020-25613

WEBRick vulnerable to HTTP Request/Response Smuggling

Impact

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Affected packages

EcosystemPackageAffectedFixed in
rubygemswebrick= 1.6.01.6.1

Affected products

VendorProductAffected versions
Ruby-LangRuby
through 2.5.8
from 2.6.0 through 2.6.6
from 2.7.0 through 2.7.1
Ruby-LangWebrick
through 1.6.0
FedoraprojectFedora
Versions 32, 33

Weakness classification

CWE-444

References