CVE-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.3). (BZ#1951999)

Security Fix(es):

• ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

• ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Resolv::DNS: ruby:2.7/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [Rocky Linux-8] (BZ#1952000)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

Security Fix(es):

• ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

• ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

• ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

• rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

• ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

• ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

• ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

• ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

Security Fix(es):

• rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)

• ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

• ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

• ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

• rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

• ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

• ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

• ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

• ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [Rocky Linux-8] (BZ#1954968)

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.3). (BZ#1951999)

Security Fix(es):

• ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

• ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Resolv::DNS: ruby:2.7/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1952000)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

Security Fix(es):

• ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

• ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

• ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

• rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

• ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

• ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

• ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

• ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

Security Fix(es):

• rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)

• ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

• ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

• ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

• rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

• ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

• ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

• ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

• ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1954968)

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request (CVE-2020-25613).

Response Splitting attack in the HTTP server of WEBrick (CVE-2017-17742).

Delete directory using symlink when decompressing tar (CVE-2019-8320).

Escape sequence injection vulnerability in verbose (CVE-2019-8321).

Escape sequence injection vulnerability in gem owner (CVE-2019-8322).

Escape sequence injection vulnerability in API response handling (CVE-2019-8323).

Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324).

Escape sequence injection vulnerability in errors (CVE-2019-8325).

Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication (CVE-2019-16201).

HTTP Response Splitting attack in the HTTP server of WEBrick (CVE-2019-16254).

Code injection vulnerability (CVE-2019-16255).

A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with jruby) was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to "smuggle" a request (CVE-2020-25613).

This update for ruby2.5 fixes the following issues:

• CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick (bsc#1177125).
• Enable optimizations also on ARM64 (bsc#1177222)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libruby2_7-2_7-2.7.3-3.2 package on the GA media of openSUSE Tumbleweed.

This update for ruby2.5 fixes the following issues:

• CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick (bsc#1177125).
• Enable optimizations also on ARM64 (bsc#1177222)

This update for ruby2.1 fixes the following issues:

• CVE-2020-25613: Fixed potential HTTP request smuggling in WEBrick (bsc#1177125).
• CVE-2021-31799: Fixed Command injection vulnerability in RDoc (bsc#1190375).
• CVE-2021-31810: Fixed trusting FTP PASV responses vulnerability in Net:FTP (bsc#1188161).
• CVE-2021-32066: Fixed StartTLS stripping vulnerability in Net:IMAP (bsc#1188160).

It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into parsing a specially crafted JSON file, a remote attacker could use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10663)

It was discovered that Ruby incorrectly handled certain socket memory operations. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-10933)

It was discovered that Ruby incorrectly handled certain transfer-encoding headers when using Webrick. A remote attacker could possibly use this issue to bypass a reverse proxy. (CVE-2020-25613)