HTTP Response Splitting Vulnerability in Ruby Package
Summary
ALPINE-CVE-2019-16254: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. Affects ruby versions < 2.5.7-r0. Fixed in 2.5.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development, particularly with the Ruby on Rails framework. The Ruby package is essential for executing Ruby scripts and applications. However, it has been found to be vulnerable to an HTTP Response Splitting issue, which can lead to serious security risks if untrusted input is processed in response headers.
Vulnerability Detail
Ruby through versions 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 is susceptible to an HTTP Response Splitting vulnerability. This flaw arises when a program using WEBrick, a Ruby web server, incorporates untrusted input into the response header. An attacker can exploit this vulnerability by inserting a newline character, allowing them to split a header and inject malicious content. This can mislead clients and potentially lead to further attacks. The issue stems from an incomplete fix for CVE-2017-17742, which only addressed the CRLF vector but did not account for isolated CR or LF characters.
How To Fix
Minimum fixed version
2.5.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any untrusted input is sanitized before being included in response headers. This can be done by validating and escaping any user input that may be included in headers.
Conclusion
The HTTP Response Splitting vulnerability in the Ruby package poses significant risks if untrusted input is processed in response headers. It is essential to update to the patched versions to mitigate these risks. Additionally, employing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for ruby →
FAQ
HTTP Response Splitting is a vulnerability that allows an attacker to manipulate HTTP headers, potentially leading to the injection of malicious content.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploiting this vulnerability can lead to client deception, data leakage, and further attacks on the application.
Yes, updating to the specified patched versions of the Ruby package will permanently fix the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file, without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
