CVE-2017-17742

Description

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

How to fix CVE-2017-17742

To remediate CVE-2017-17742, upgrade the affected package to a fixed version below.

• Alpine/ruby—upgrade to 2.5.1-r0 or later
• —upgrade to 1.5.6-9+deb8u2 or later
• —upgrade to 1.7.26-1+deb9u2 or later
• —upgrade to 9.3.9.0+ds-1 or later
• —upgrade to 9.1.17.0-3+deb10u1 or later
• —upgrade to 1.8.7.358-7.1+deb7u6 or later
• —upgrade to 1.9.3.194-8.1+deb7u8 or later

Is CVE-2017-17742 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 2.5.1-r0
• from 0, < 1.5.6-9+deb8u2
• from 0, < 1.7.26-1+deb9u2
• from 0, < 9.3.9.0+ds-1
• from 0, < 9.1.17.0-3+deb10u1
• from 0, < 1.8.7.358-7.1+deb7u6
• from 0, < 1.9.3.194-8.1+deb7u8

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-17742
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-17742