CVE-2017-17742
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') (CWE-113)
Published: Apr 3, 2018 / Updated: 51mo ago
010
No CVSS yetEPSS 0.93%
CVE info copied to clipboard
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
Timeline
First Article
Feedly found the first article mentioning CVE-2017-17742. See article
Mar 28, 2018 at 8:14 PM / devcenter.heroku.com
EPSS
EPSS Score was set to: 0.93% (Percentile: 81.3%)
Nov 22, 2023 at 6:27 PM
Detection in Vulnerability Scanners
Detection for the vulnerability has been added to Nessus (191511)
Mar 5, 2024 at 12:15 AM
Affected Systems
Ruby-lang/ruby
+null more
Patches
www.ruby-lang.org
+null more
Attack Patterns
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
+null more
References
Multiple vulnerabilities in Dell EMC Data Protection Search
The vulnerability allows a local user to perform a denial of service (DoS) attack or gain access to sensitive information. Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
News
redhat_unpatched ruby: ruby: Unpatched vulnerabilities
Development Last Updated: 7/11/2024 CVEs: CVE-2014-8090 , CVE-2021-41817 , CVE-2018-8778 , CVE-2014-8080 , CVE-2017-17790 , CVE-2015-9096 , CVE-2018-8780 , CVE-2017-17742 , CVE-2019-15845 , CVE-2009-5147 , CVE-2019-16161 , CVE-2016-2339 , CVE-2017-10784 , CVE-2015-7551 , CVE-2017-17405 , CVE-2014-6438 , CVE-2023-28756 , CVE-2019-16162 , CVE-2016-2337 , CVE-2018-8777 , CVE-2015-3900 , CVE-2019-16201 , CVE-2016-7798 , CVE-2019-16255 , CVE-2020-25613 , CVE-2018-16396 , CVE-2015-1855 , CVE-2018-6914 , CVE-2022-28739 , CVE-2018-16395 , CVE-2019-16254
redhat_unpatched ruby: ruby: Unpatched vulnerabilities
Development Last Updated: 6/3/2024 CVEs: CVE-2014-8090 , CVE-2021-41817 , CVE-2018-8778 , CVE-2014-8080 , CVE-2017-17790 , CVE-2015-9096 , CVE-2018-8780 , CVE-2017-17742 , CVE-2019-15845 , CVE-2009-5147 , CVE-2019-16161 , CVE-2016-2339 , CVE-2017-10784 , CVE-2015-7551 , CVE-2017-17405 , CVE-2014-6438 , CVE-2023-28756 , CVE-2019-16162 , CVE-2016-2337 , CVE-2023-28755 , CVE-2018-8777 , CVE-2015-3900 , CVE-2019-16201 , CVE-2016-7798 , CVE-2019-16255 , CVE-2020-25613 , CVE-2018-16396 , CVE-2015-1855 , CVE-2018-6914 , CVE-2022-28739 , CVE-2018-16395 , CVE-2019-16254
RHEL 6 : ruby (Unpatched Vulnerability)
Nessus Plugin ID 195418 with Critical Severity Synopsis The remote Red Hat 6 host is affected by multiple vulnerabilities that will not be patched. Description The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ruby: Command injection vulnerability in Net::FTP (CVE-2017-17405) - ruby: OpenSSL::X509::Name equality check does not work correctly (CVE-2018-16395) - Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as retval argument can cause arbitrary code execution. (CVE-2016-2337) - An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer head allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow. (CVE-2016-2338) - The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
RHEL 6 / 7 : rh-ruby24-ruby (RHSA-2018:3730)
- rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) - ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780)
redhat RHSA-2018:3730: RHSA-2018:3730: rh-ruby24-ruby security, bug fix, and enhancement update (Important)
Development Last Updated: 4/22/2024 CVEs: CVE-2018-16395 , CVE-2018-1000075 , CVE-2018-1000079 , CVE-2018-8780 , CVE-2018-1000077 , CVE-2018-1000078 , CVE-2018-1000076 , CVE-2018-1000073 , CVE-2018-1000074 , CVE-2018-8779 , CVE-2018-16396 , CVE-2018-8778 , CVE-2018-6914 , CVE-2017-17742 , CVE-2018-8777
See 178 more articles and social media posts