Non évaluée
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input in...
CVE-2019-16254
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2019-16254 ruby Corrigé dans: 2.5.7-r0
- Debian DEBIAN-CVE-2019-16254 jruby Corrigé dans: 9.3.9.0+ds-1
Description d'origine La description telle que publiée par la source (souvent en anglais).
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
Références
- advisory hackerone.com
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory debian.org
- advisory debian.org
- advisory ruby-lang.org
- advisory ruby-lang.org
- advisory ruby-lang.org
- advisory ruby-lang.org
- web lists.opensuse.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web seclists.org
- web seclists.org
- web oracle.com