High severityNVD Advisory· Published Oct 6, 2020· Updated Aug 4, 2024
CVE-2020-25613
CVE-2020-25613
Description
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
webrickRubyGems | >= 1.6.0, < 1.6.1 | 1.6.1 |
webrickRubyGems | >= 1.5.0, < 1.5.1 | 1.5.1 |
webrickRubyGems | < 1.4.4 | 1.4.4 |
Affected products
45- Ruby/WEBrickdescription
- osv-coords44 versionspkg:bitnami/rubypkg:bitnami/ruby-minpkg:gem/webrickpkg:rpm/almalinux/rubygem-abrtpkg:rpm/almalinux/rubygem-abrt-docpkg:rpm/almalinux/rubygem-bsonpkg:rpm/almalinux/rubygem-bson-docpkg:rpm/almalinux/rubygem-mongopkg:rpm/almalinux/rubygem-mongo-docpkg:rpm/almalinux/rubygem-mysql2pkg:rpm/almalinux/rubygem-mysql2-docpkg:rpm/almalinux/rubygem-pgpkg:rpm/almalinux/rubygem-pg-docpkg:rpm/opensuse/ruby2.5&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/ruby2.7&distro=openSUSE%20Tumbleweedpkg:rpm/suse/ruby2.1&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/ruby2.5&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Micro%205.0pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Server%204.0
< 2.5.9+ 43 more
- (no CPE)range: < 2.5.9
- (no CPE)range: < 2.5.9
- (no CPE)range: >= 1.6.0, < 1.6.1
- (no CPE)range: < 0.4.0-1.module_el8.4.0+2399+4e3a532a
- (no CPE)range: < 0.4.0-1.module_el8.5.0+118+1ab773e1
- (no CPE)range: < 4.8.1-1.module_el8.5.0+117+35d1289b
- (no CPE)range: < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 2.11.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 2.11.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 0.5.3-1.module_el8.4.0+2399+4e3a532a
- (no CPE)range: < 0.5.3-1.module_el8.5.0+118+1ab773e1
- (no CPE)range: < 1.2.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 1.2.3-1.module_el8.3.0+6147+d0dfc1e4
- (no CPE)range: < 2.5.8-lp152.2.3.1
- (no CPE)range: < 2.7.3-3.2
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.1.9-19.6.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
- (no CPE)range: < 2.5.8-4.14.1
Patches
Vulnerability mechanics
References
20- github.com/advisories/GHSA-gwfg-cqmg-cf8fghsaADVISORY
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/mitrevendor-advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/mitrevendor-advisory
- nvd.nist.gov/vuln/detail/CVE-2020-25613ghsaADVISORY
- security.gentoo.org/glsa/202401-27ghsavendor-advisoryWEB
- github.com/ruby/webrick/commit/076ac636bf48b7a492887ce4de7041de23e6c00dghsaWEB
- github.com/ruby/webrick/commit/7618049fa57ddad2efff2a7bc7dad7d2d8a311b1ghsaWEB
- github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7ghsaWEB
- github.com/ruby/webrick/commit/af2efdcdf826f25592202d187c53963e7932e4b9ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2020-25613.ymlghsaWEB
- hackerone.com/reports/965267ghsaWEB
- lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlghsamailing-listWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOVghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOVghsaWEB
- security.netapp.com/advisory/ntap-20210115-0008ghsaWEB
- www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613ghsaWEB
- security.netapp.com/advisory/ntap-20210115-0008/mitre
- www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/mitre
News mentions
0No linked articles in our index yet.