CVE-2019-16254

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-16254
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16254.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-16254
Downstream
ALPINE (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
MGASA (2)
openSUSE (1)
RHSA (9)
RLSA (2)
SUSE (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (2)
Published
2019-11-26T18:15:15Z
Modified
2026-07-08T05:55:32Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type
GIT
Repo
https://github.com/ruby/ruby
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20
Introduced
d4bb726b713658f56e630b6cf817a0155b6f390e
Last Affected
c91478058505cd8cae5160c1056bcde65af5a78b
Introduced
4e0a512972cdcbfcd5279f1a2a81ba342ed75b6e
Last Affected
189a36cfabfc30e785cece0692c802be87ebd9cf
Introduced
c1af7b1e1d408f9796a5f46c9ed36bc5adea4aa2
Last Affected
6315e42c222d5484004494950c7524a85acadb20
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "2.3.0"
        },
        {
            "introduced":  "2.4.0"
        },
        {
            "last_affected":  "2.4.7"
        },
        {
            "introduced":  "2.5.0"
        },
        {
            "last_affected":  "2.5.6"
        },
        {
            "introduced":  "2.6.0"
        },
        {
            "last_affected":  "2.6.4"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

Other
v1_0_r2
v2_3_0
v2_4_7
v2_5_6
v2_6_4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16254.json"