CVE-2017-10784
high · 8.8The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
8.8
CVSS
16.4%
EPSS (exploit prob.)
97th
EPSS percentile
2017-09-19
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| ruby-lang | ruby | <= 2.2.7 |
| ruby-lang | ruby | 2.3.0 |
| ruby-lang | ruby | 2.3.0 |
| ruby-lang | ruby | 2.3.0 |
| ruby-lang | ruby | 2.3.1 |
| ruby-lang | ruby | 2.3.2 |
| ruby-lang | ruby | 2.3.3 |
| ruby-lang | ruby | 2.3.4 |
| ruby-lang | ruby | 2.4.0 |
| ruby-lang | ruby | 2.4.0 |
| ruby-lang | ruby | 2.4.0 |
| ruby-lang | ruby | 2.4.0 |
| ruby-lang | ruby | 2.4.0 |
| ruby-lang | ruby | 2.4.1 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/100853
- http://www.securitytracker.com/id/1039363
- http://www.securitytracker.com/id/1042004
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://security.gentoo.org/glsa/201710-18
- https://usn.ubuntu.com/3528-1/
- https://usn.ubuntu.com/3685-1/
- https://www.debian.org/security/2017/dsa-4031
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
- https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
- https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
- http://www.securityfocus.com/bid/100853
- http://www.securitytracker.com/id/1039363
- http://www.securitytracker.com/id/1042004
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://security.gentoo.org/glsa/201710-18
- https://usn.ubuntu.com/3528-1/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2017-10784