CVE-2019-16254Injection in Ruby

Severity
5.3MEDIUMNVD
EPSS
0.7%
top 27.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 26
Latest updateMay 24

Description

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

Debianjruby/jruby< 9.3.9.0+ds-1+2
NVDruby-lang/ruby2.4.02.4.7+3
CVEListV5puma/puma< 3.12.3+1

Also affects: Debian Linux 8.0

🔴Vulnerability Details

5
GHSA
GHSA-w9fp-2996-hhwx: Ruby through 22022-05-24
GHSA
HTTP Response Splitting in Puma2020-02-28
OSV
CVE-2019-16254: Ruby through 22019-11-26
CVEList
CVE-2019-16254: Ruby through 22019-11-26
OSV
ruby2.3, ruby2.5 vulnerabilities2019-11-26

📋Vendor Advisories

5
Red Hat
rubygem-puma: attacker is able to use newline characters to insert malicious content (HTTP Response Splitting), this could lead to XSS2020-03-02
Ubuntu
Ruby vulnerabilities2019-11-26
Microsoft
Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header an attacker can exploit it to2019-11-12
Red Hat
ruby: HTTP response splitting in WEBrick2019-10-25
Debian
CVE-2019-16254: jruby - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Res...2019

💬Community

3
Bugzilla
CVE-2019-16254 ruby: HTTP response splitting in WEBrick (Additional fix) [fedora-all]2020-01-09
Bugzilla
CVE-2019-16254 ruby: HTTP response splitting in WEBrick2020-01-09
HackerOne
HTTP header can split /[\r\n]/ instead of /\r\n/2019-10-25
CVE-2019-16254 — Injection in Ruby-lang Ruby | cvebase