未評価
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input in...
CVE-2019-16254
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2019-16254 ruby 修正版: 2.5.7-r0
- Debian DEBIAN-CVE-2019-16254 jruby 修正版: 9.3.9.0+ds-1
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
参照URL
- advisory hackerone.com
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory debian.org
- advisory debian.org
- advisory ruby-lang.org
- advisory ruby-lang.org
- advisory ruby-lang.org
- advisory ruby-lang.org
- web lists.opensuse.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web seclists.org
- web seclists.org
- web oracle.com