WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request. Reference: https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/
Created ruby tracking bugs for this issue: Affects: fedora-all [bug 1883624]
Just FTR, I don't think this should really impact any of RH products, because they are very likely using different HTTP server, such as rubygem-puma. WEBrick is targeted more for development use, if there is no other option.
Upstream commit for this issue: https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7
External References: https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/
Ruby versions 2.5.9, 2.6.7, and 2.7.2 include the fixed version of webrick: https://www.ruby-lang.org/en/news/2020/10/02/ruby-2-7-2-released/ https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-6-7-released/ https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-5-9-released/
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:2104 https://access.redhat.com/errata/RHSA-2021:2104
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25613
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:2229 https://access.redhat.com/errata/RHSA-2021:2229
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:2230 https://access.redhat.com/errata/RHSA-2021:2230
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2584 https://access.redhat.com/errata/RHSA-2021:2584
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2587 https://access.redhat.com/errata/RHSA-2021:2587
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2588 https://access.redhat.com/errata/RHSA-2021:2588
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:0581 https://access.redhat.com/errata/RHSA-2022:0581
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:0582 https://access.redhat.com/errata/RHSA-2022:0582