CVE-2017-10784

Description

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

References

https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/

https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/

https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/

https://www.debian.org/security/2017/dsa-4031

https://usn.ubuntu.com/3685-1/

https://usn.ubuntu.com/3528-1/

https://security.gentoo.org/glsa/201710-18

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

https://access.redhat.com/errata/RHSA-2018:0585

https://access.redhat.com/errata/RHSA-2018:0583

https://access.redhat.com/errata/RHSA-2018:0378

https://access.redhat.com/errata/RHSA-2017:3485

http://www.securitytracker.com/id/1042004

http://www.securitytracker.com/id/1039363

http://www.securityfocus.com/bid/100853

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3