Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1561952 - (CVE-2017-17742) CVE-2017-17742 ruby: HTTP response splitting in WEBrick
CVE-2017-17742 ruby: HTTP response splitting in WEBrick
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20180328,repor...
: Security
Depends On: 1567035 1567037 1567038 1567039 1561956 1561957 1561958 1563873 1563874 1565258 1567036
Blocks: 1561954
  Show dependency treegraph
 
Reported: 2018-03-29 05:08 EDT by Adam Mariš
Modified: 2018-07-17 08:33 EDT (History)
29 users (show)

See Also:
Fixed In Version: ruby 2.2.10, ruby 2.3.7, ruby 2.4.4, ruby 2.5.1
Doc Type: If docs needed, set a value
Doc Text:
It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2018-03-29 05:08:50 EDT
If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients.

Affected versions:

Ruby 2.2 series: 2.2.9 and earlier
Ruby 2.3 series: 2.3.6 and earlier
Ruby 2.4 series: 2.4.3 and earlier
Ruby 2.5 series: 2.5.0 and earlier

External References:

https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/
Comment 1 Adam Mariš 2018-03-29 05:15:12 EDT
Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1561957]
Comment 7 Cedric Buissart 2018-04-17 06:08:18 EDT
Mitigation:

The server can manually sanitize possibly untrusted headers prior to inserting them in the reply.
Comment 8 Andrej Nemec 2018-05-14 11:26:51 EDT
Statement:

This issue affects the versions of ruby as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of ruby as shipped with Red Hat Subscription Asset Manager 1. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.