CVE-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type

GIT

Repo

https://github.com/ruby/ruby

Events

Introduced

Last affected

4992d9fd706a9cbe98c4b94e2dbcfc10e317e091

Introduced

c1af7b1e1d408f9796a5f46c9ed36bc5adea4aa2

Last affected

27958c2bd64b27d529f81a130bd488ccc6b9b1d4

Introduced

647ee6f091eafcce70ffb75ddf7e121e192ab217

Last affected

a0c7c23c9cec0d0ffcba012279cd652d28ad5bf3

Introduced

Last affected

b7b94c375fa2f5ee48c41b4310e501d6cb479c9c

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.8"
        },
        {
            "introduced": "2.6.0"
        },
        {
            "last_affected": "2.6.6"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.6.0"
        }
    ]
}

Type: GIT
Repo: https://github.com/ruby/webrick
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8946bb38b4d87549f0d99ed73c62c41933f97cc7

Affected versions

v1.*

v1.4.0

v1.4.0.beta1

v1.4.1

v1.4.2

v1.5.0

v1.6.0

Other

v2_7_0

v2_7_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25613.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    }
]