An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
References
Link | Resource |
---|---|
https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7 | Patch Third Party Advisory |
https://hackerone.com/reports/965267 | Permissions Required Third Party Advisory |
https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/ | Vendor Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/ | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20210115-0008/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Information
Published : 2020-10-06 06:15
Updated : 2022-01-01 10:16
NVD link : CVE-2020-25613
Mitre link : CVE-2020-25613
JSON object : View
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Products Affected
ruby-lang
- webrick
- ruby
fedoraproject
- fedora