USN-7057-1: WEBrick vulnerability
Published Oct 7, 2024
·Updated
It was discovered that WEBrick incorrectly handled having both a Content- Length header and a Transfer-Encoding header. A remote attacker could possibly use this issue to perform a HTTP request smuggling attack.
Affected Software
2 affected componentsFixes available
All of the following
ubuntu/ruby-webrick<1.8.1-1ubuntu0.1
1.8.1-1ubuntu0.1
Ubuntu Ubuntu=24.04
Event History
Oct 7, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7057-1?
USN-7057-1 is classified as a medium severity vulnerability.
2
How do I fix USN-7057-1?
To fix USN-7057-1, update the ruby-webrick package to version 1.8.1-1ubuntu0.1 or later.
3
What type of attack does USN-7057-1 allow?
USN-7057-1 potentially allows a remote attacker to perform HTTP request smuggling.
4
Which software versions are affected by USN-7057-1?
USN-7057-1 affects ruby-webrick version below 1.8.1-1ubuntu0.1 on Ubuntu 24.04.
5
What is the cause of the vulnerability USN-7057-1?
The vulnerability USN-7057-1 is caused by WEBrick's improper handling of simultaneous Content-Length and Transfer-Encoding headers.