High severity8.8NVD Advisory· Published Sep 19, 2017· Updated Jun 17, 2026
CVE-2017-10784
CVE-2017-10784
Description
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
webrickRubyGems | < 1.4.0 | 1.4.0 |
Affected products
36cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*+ 13 more
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*range: <=2.2.7
- cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*
- ghsa-coords22 versionspkg:gem/webrickpkg:rpm/suse/ruby2.1&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/ruby2.1&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20OpenStack%20Cloud%207
< 1.4.0+ 21 more
- (no CPE)range: < 1.4.0
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 3.1.53-9.8.1
- (no CPE)range: < 3.1.53-9.8.1
- (no CPE)range: < 3.1.53-9.8.1
- (no CPE)range: < 3.1.53-9.8.1
Patches
Vulnerability mechanics
References
29- www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/nvdPatchVendor Advisory
- www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/nvdPatchVendor Advisory
- www.securityfocus.com/bid/100853nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1039363nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-369m-2gv6-mw28ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-10784ghsaADVISORY
- www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/nvdVendor Advisory
- access.redhat.com/errata/RHSA-2017:3485nvdWEB
- access.redhat.com/errata/RHSA-2018:0378nvdWEB
- access.redhat.com/errata/RHSA-2018:0583nvdWEB
- access.redhat.com/errata/RHSA-2018:0585nvdWEB
- github.com/ruby/ruby/commit/6617c41292ghsaWEB
- github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.ymlghsaWEB
- hackerone.com/reports/223363ghsaWEB
- lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlnvdWEB
- security.gentoo.org/glsa/201710-18nvdWEB
- usn.ubuntu.com/3528-1ghsaWEB
- usn.ubuntu.com/3685-1ghsaWEB
- web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853ghsaWEB
- web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004ghsaWEB
- web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363ghsaWEB
- www.debian.org/security/2017/dsa-4031nvdWEB
- www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-releasedghsaWEB
- www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-releasedghsaWEB
- www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784ghsaWEB
- www.securitytracker.com/id/1042004nvd
- usn.ubuntu.com/3528-1/nvd
- usn.ubuntu.com/3685-1/nvd
News mentions
0No linked articles in our index yet.