system/ruby: CVE-2020-25613: HTTP request smuggling
Bugzilla ID | 376 |
Alias(es) | CVE-2020-25613 |
Reporter | Max Rees (sroracle) |
Assignee | Max Rees (sroracle) |
Reported | 2020-11-21 22:42:56 -0600 |
Modified | 2020-11-21 22:42:56 -0600 |
Status | UNCONFIRMED |
Version | 1.0-RC1 |
Hardware | Adélie Linux / All |
Importance | --- / normal |
Package(s) | system/ruby |
URL | https://nvd.nist.gov/vuln/detail/CVE-2020-25613 |
Description
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6,
and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with
Ruby, had not checked the transfer-encoding header value rigorously.
An attacker may potentially exploit this issue to bypass a reverse
proxy (which also has a poor header check), which may lead to an HTTP
Request Smuggling attack.
Fixed in >= webrick 1.6.1
https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7
This fix is included in ruby >= 2.7.2
https://www.ruby-lang.org/en/news/2020/10/02/ruby-2-7-2-released/