GHSA-369m-2gv6-mw28
WEBrick RCE Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2017-10784
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · webrick | introduced 0, fixed 1.4.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-10784 ADVISORY
- https://github.com/ruby/ruby/commit/6617c41292 WEB
- https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813 WEB
- https://hackerone.com/reports/223363 WEB
- https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784 WEB
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released WEB
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released WEB
- https://www.debian.org/security/2017/dsa-4031 WEB
- https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363 WEB
- https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004 WEB
- https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853 WEB
- https://usn.ubuntu.com/3685-1 WEB
- https://usn.ubuntu.com/3528-1 WEB
- https://security.gentoo.org/glsa/201710-18 WEB
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml WEB
- https://github.com/ruby/webrick PACKAGE
- https://access.redhat.com/errata/RHSA-2018:0585 WEB
- https://access.redhat.com/errata/RHSA-2018:0583 WEB
- https://access.redhat.com/errata/RHSA-2018:0378 WEB
- https://access.redhat.com/errata/RHSA-2017:3485 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |