Posted by mame on 29 Sep 2020
A potential HTTP request smuggling vulnerability in WEBrick was reported. This vulnerability has been assigned the CVE identifier CVE-2020-25613. We strongly recommend upgrading the webrick gem.
Details
WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request. See CWE-444 in detail.
Please update the webrick gem to version 1.6.1 or later. You can use gem update webrick
to update it. If you are using bundler, please add gem "webrick", ">= 1.6.1"
to your Gemfile
.
Affected versions
- webrick gem 1.6.0 or prior
- bundled versions of webrick in ruby 2.7.1 or prior
- bundled versions of webrick in ruby 2.6.6 or prior
- bundled versions of webrick in ruby 2.5.8 or prior
Credits
Thanks to piao for discovering this issue.
History
- Originally published at 2020-09-29 06:30:00 (UTC)