An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
24 Jan 2024, 05:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
30 Apr 2023, 23:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
01 Jan 2022, 18:16
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | |
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20210115-0008/ - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/ - Mailing List, Third Party Advisory |
Information
Published : 2020-10-06 13:15
Updated : 2024-02-04 21:23
NVD link : CVE-2020-25613
Mitre link : CVE-2020-25613
CVE.ORG link : CVE-2020-25613
JSON object : View
Products Affected
ruby-lang
- webrick
- ruby
fedoraproject
- fedora
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')