REDHAT-BUG-2314051: Medium severity Ruby WEBrick vulnerability
An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2314051?
The severity of REDHAT-BUG-2314051 is considered high due to its potential for HTTP request smuggling.
How do I fix REDHAT-BUG-2314051?
To mitigate REDHAT-BUG-2314051, upgrade Ruby WEBrick to a version higher than 1.8.1.
What versions of WEBrick are affected by REDHAT-BUG-2314051?
WEBrick versions up to and including 1.8.1 are affected by REDHAT-BUG-2314051.
What type of attack does REDHAT-BUG-2314051 facilitate?
REDHAT-BUG-2314051 facilitates HTTP request smuggling attacks.
Is there a workaround for REDHAT-BUG-2314051?
A temporary workaround for REDHAT-BUG-2314051 can involve disabling HTTP request smuggling techniques by reviewing request headers.