CVE-2020-25613: High severity ruby-lang Ruby vulnerability

Q: What is the severity of CVE-2020-25613?

The severity of CVE-2020-25613 is high.

Q: How does CVE-2020-25613 affect Ruby versions?

CVE-2020-25613 affects Ruby versions 2.5.8 through 2.5.9, 2.6.0 through 2.6.6, and 2.7.0 through 2.7.1.

Q: What is WEBrick?

WEBrick is a simple HTTP server bundled with Ruby.

Q: What is HTTP request smuggling?

HTTP request smuggling is a vulnerability that allows an attacker to bypass security measures in reverse proxies by sending specially crafted requests that are interpreted differently by the proxy and the server handling the request.

Q: How can I fix CVE-2020-25613?

To fix CVE-2020-25613, upgrade Ruby to version 2.5.9, 2.6.7, or 2.7.2, or apply the appropriate patches provided by your distribution.

Published Sep 29, 2020

Updated

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Other sources

WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request.

Reference: https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/

— Red Hat

Affected Software

16 affected componentsFixes available

redhat/rh-ruby25-ruby<0:2.5.9-9.el7

0:2.5.9-9.el7

redhat/rh-ruby27-ruby<0:2.7.3-129.el7

0:2.7.3-129.el7

redhat/rh-ruby26-ruby<0:2.6.7-119.el7

0:2.6.7-119.el7

redhat/rubygem-webrick<1.6.1

1.6.1

redhat/ruby<2.5.9

2.5.9

redhat/ruby<2.6.7

2.6.7

redhat/ruby<2.7.2

2.7.2

ruby-lang Ruby<=2.5.8

ruby-lang Ruby>=2.6.0<=2.6.6

ruby-lang Ruby>=2.7.0<=2.7.1

ruby-lang Webrick Ruby<=1.6.0

Fedoraproject Fedora=32

Fedoraproject Fedora=33

rubygems/webrick<1.4.4

1.4.4

rubygems/webrick=1.5.0

1.5.1

rubygems/webrick=1.6.0

1.6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/rh-ruby25-ruby to a version that resolves this vulnerability.
Fixed in 0:2.5.9-9.el7
Upgrade
Upgrade redhat/rh-ruby27-ruby to a version that resolves this vulnerability.
Fixed in 0:2.7.3-129.el7
Upgrade
Upgrade redhat/rh-ruby26-ruby to a version that resolves this vulnerability.
Fixed in 0:2.6.7-119.el7
Upgrade
Upgrade rubygems/webrick to a version that resolves this vulnerability.
Fixed in 1.4.4
Upgrade
Upgrade rubygems/webrick to a version that resolves this vulnerability.
Fixed in 1.5.1
Upgrade
Upgrade rubygems/webrick to a version that resolves this vulnerability.
Fixed in 1.6.1
Upgrade
Upgrade redhat/rubygem-webrick to a version that resolves this vulnerability.
Fixed in 1.6.1
Upgrade
Upgrade redhat/ruby to a version that resolves this vulnerability.
Fixed in 2.5.9
Upgrade
Upgrade redhat/ruby to a version that resolves this vulnerability.
Fixed in 2.6.7
Upgrade
Upgrade redhat/ruby to a version that resolves this vulnerability.
Fixed in 2.7.2

Event History

Sep 29, 2020

CVE Published

12:00 AM

Data Sourced

via Red Hat·05:59 PM

DescriptionSeverityAffected Software

Oct 6, 2020

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

May 24, 2022

Advisory Published

via GitHub·05:30 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2020-25613?