CVE-2017-17742

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type

GIT

Repo

https://github.com/ruby/ruby

Events

Introduced

7393bf6a5cfff63683f36535e293caaa0d4c5be0

Fixed

933bb2b8b57c48dc664fce6d752670e6521a4141

Introduced

d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20

Fixed

9bfe7fc5cb457c7bc8df96115ee70b9035f5d885

Introduced

d4bb726b713658f56e630b6cf817a0155b6f390e

Fixed

a8197e08f58c5f2e6d32a774866e0e0d58749911

Introduced

4e0a512972cdcbfcd5279f1a2a81ba342ed75b6e

Fixed

85883dc393f60adc3043d28899eff3f1ce53b4a5

Introduced

Last affected

ce0e3fc1b10d1f5c5ad6bc31ba344904345468a2

Database specific

{
    "versions": [
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.10"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.7"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "fixed": "2.4.4"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.5.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6.0-preview1"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-17742.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    }
]