Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-25613 | 2 Fedoraproject, Ruby-lang | 3 Fedora, Ruby, Webrick | 2022-01-01 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack. | |||||
| CVE-2019-11879 | 1 Ruby-lang | 1 Webrick | 2020-08-24 | 2.1 LOW | 5.5 MEDIUM |
| ** DISPUTED ** The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem." | |||||