Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
172
security advisoryremote accessubuntuUbuntu 24.04 LTS: USN-7057-1 critical: WEBrick HTTP smuggling risk
WEBrick could allow a HTTP request smuggling attack.. ========================================================================== Ubuntu Security Notice USN-7057-1 October 07, 2024 ruby-webrick vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: WEBrick could allow a HTTP request smuggling attack. Software Description: - ruby-webrick: HTTP server toolkit in Ruby Details: It was discovered that WEBrick incorrectly handled having both a Content- Length header and a Transfer-Encoding header. A remote attacker could possibly use this issue to perform a HTTP request smuggling attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS ruby-webrick 1.8.1-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7057-1 CVE-2024-47220 Package Information: https://launchpad.net/ubuntu/+source/ruby-webrick/1.8.1-1ubuntu0.1 . Ubuntu patches address WEBrick flaw associated with HTTP request smuggling. Seek mitigation strategies and respond promptly!. Ubuntu Security Update, WEBrick Mitigation, HTTP Attack Prevention, Ruby WEBrick Advisory. . Severity: Critical. LinuxSecurity.com Team
Oct 07, 2024
•Critical
Ubuntu
203
security advisorysecurity issuecriticalMageia: 2020-0423 Moderate: Ruby WEBrick HTTP Request Smuggling
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request (CVE-2020-25613). . MGASA-2020-0423 - Updated ruby packages fix a security vulnerability Publication date: 13 Nov 2020 URL: https://advisories.mageia.org/MGASA-2020-0423.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-25613 A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request (CVE-2020-25613). References: - https://bugs.mageia.org/show_bug.cgi?id=27401 - https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/ - https://www.cve.org/CVERecord?id=CVE-2020-25613 SRPMS: - 7/core/ruby-2.5.8-22.mga7 . Mageia 2020-0423 security fix tackles a severe HTTP request smuggling vulnerability linked to WEBrick’s management of incoming request headers.. Mageia security advisory, WEBrick update, HTTP request issue, Ruby vulnerability. . LinuxSecurity.com Team
Nov 13, 2020
Mageia
197
security advisoryupdatedebianDebian LTS: DLA-2392-1 Critical WEBrick Request Smuggling Issue
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with jruby) was too tolerant against . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2392-1
Oct 01, 2020
•Critical
Debian LTS
197
security advisorysecurity issuecriticalDebian LTS: DLA-2391-1 ruby2.3 Critical: WEBrick HTTP Request Smuggling
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with ruby2.3) was too tolerant against . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2391-1
Oct 01, 2020
•Critical
Debian LTS
91
security advisorydenial of servicegentooGentoo: GLSA-202103-15 Critical Risk of Ruby Denial of Service
Ruby WEBrick and XMLRPC servers are vulnerable to Denial of Service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200605-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Ruby: Denial of Service Date: May 10, 2006 Bugs: #130657 ID: 200605-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Ruby WEBrick and XMLRPC servers are vulnerable to Denial of Service. Background ========= Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with HTTP ("WEBrick") and XMLRPC server objects. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/ruby < 1.8.4-r1 > = 1.8.4-r1 Description ========== Ruby uses blocking sockets for WEBrick and XMLRPC servers. Impact ===== An attacker could send large amounts of data to an affected server to block the socket and thus deny other connections to the server. Workaround ========= There is no known workaround at this time. Resolution ========= All Ruby users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-lang/ruby-1.8.4-r1" References ========= [ 1 ] CVE-2006-1931 https://www.cve.org/CVERecord?id=CVE-2006-1931 [ 2 ] Ruby release announcement Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200605-11 Concerns? ======== Security is a primary focus of Gentoo Linux andensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
May 10, 2006
•Critical
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!