CVE-2024-47220

EUVD-2024-2733
An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
rubywebrick
𝑥
≤ 1.8.1
ADP
Debian logo
Debian Releases
Debian Product
Codename
ruby-webrick
bookworm
no-dsa
forky
1.9.1-1
fixed
sid
1.9.1-1
fixed
trixie
1.9.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-webrick
focal
dne
jammy
Fixed 1.7.0-3ubuntu0.1
released
noble
Fixed 1.8.1-1ubuntu0.1
released
oracular
Fixed 1.8.1-1ubuntu1
released
plucky
Fixed 1.8.1-1ubuntu1
released
questing
Fixed 1.8.1-1ubuntu1
released
jruby
bionic
needed
focal
needed
jammy
dne
noble
not-affected
plucky
not-affected
questing
not-affected
trusty
needed
xenial
needed
ruby2.3
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
Fixed 2.3.1-2~ubuntu16.04.16+esm11
released
ruby2.5
bionic
Fixed 2.5.1-1ubuntu1.16+esm6
released
jammy
dne
noble
dne
plucky
dne
questing
dne
ruby2.7
focal
Fixed 2.7.0-5ubuntu1.18+esm3
released
jammy
dne
noble
dne
plucky
dne
questing
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby2_1-2_1
suse enterprise server 12 SP3
2.1.9-19.9.1
fixed
suse enterprise server 12 SP5
2.1.9-19.9.1
fixed
libruby2_5-2_5
suse enterprise desktop 15 SP6
2.5.9-150000.4.41.1
fixed
suse enterprise desktop 15 SP7
2.5.9-150700.24.3.1
fixed
suse enterprise sap 15 SP3
2.5.9-150000.4.41.1
fixed
suse enterprise sap 15 SP4
2.5.9-150000.4.41.1
fixed
suse enterprise sap 15 SP5
2.5.9-150000.4.41.1
fixed
suse enterprise sap 15 SP6
2.5.9-150000.4.41.1
fixed
suse enterprise sap 15 SP7
2.5.9-150700.24.3.1
fixed
suse enterprise server 15 SP2
2.5.9-150000.4.41.1
fixed
suse enterprise server 15 SP3
2.5.9-150000.4.41.1
fixed
suse enterprise server 15 SP4
2.5.9-150000.4.41.1
fixed
suse enterprise server 15 SP5
2.5.9-150000.4.41.1
fixed
suse enterprise server 15 SP6
2.5.9-150000.4.41.1
fixed
suse enterprise server 15 SP7
2.5.9-150700.24.3.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ruby
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby-debuginfo
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby-devel
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby-doc
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby-irb
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby-libs
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby-tcltk
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.13
fixed
ruby3.2
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-bundled-gems
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-bundled-gems-debuginfo
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-debuginfo
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-debugsource
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-default-gems
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-devel
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-doc
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-libs
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-libs-debuginfo
Amazon Linux 2023
0:3.2.2-180.amzn2023.0.4
fixed
ruby3.2-rubygem-bigdecimal
Amazon Linux 2023
0:3.1.3-180.amzn2023.0.4
fixed
ruby3.2-rubygem-bigdecimal-debuginfo
Amazon Linux 2023
0:3.1.3-180.amzn2023.0.4
fixed
ruby3.2-rubygem-bundler
Amazon Linux 2023
0:2.4.10-180.amzn2023.0.4
fixed
ruby3.2-rubygem-io-console
Amazon Linux 2023
0:0.6.0-180.amzn2023.0.4
fixed
ruby3.2-rubygem-io-console-debuginfo
Amazon Linux 2023
0:0.6.0-180.amzn2023.0.4
fixed
ruby3.2-rubygem-irb
Amazon Linux 2023
0:1.6.2-180.amzn2023.0.4
fixed
ruby3.2-rubygem-json
Amazon Linux 2023
0:2.6.3-180.amzn2023.0.4
fixed
ruby3.2-rubygem-json-debuginfo
Amazon Linux 2023
0:2.6.3-180.amzn2023.0.4
fixed
ruby3.2-rubygem-minitest
Amazon Linux 2023
0:5.16.3-180.amzn2023.0.4
fixed
ruby3.2-rubygem-power_assert
Amazon Linux 2023
0:2.0.3-180.amzn2023.0.4
fixed
ruby3.2-rubygem-psych
Amazon Linux 2023
0:5.0.1-180.amzn2023.0.4
fixed
ruby3.2-rubygem-psych-debuginfo
Amazon Linux 2023
0:5.0.1-180.amzn2023.0.4
fixed
ruby3.2-rubygem-rake
Amazon Linux 2023
0:13.0.6-180.amzn2023.0.4
fixed
ruby3.2-rubygem-rbs
Amazon Linux 2023
0:2.8.2-180.amzn2023.0.4
fixed
ruby3.2-rubygem-rbs-debuginfo
Amazon Linux 2023
0:2.8.2-180.amzn2023.0.4
fixed
ruby3.2-rubygem-rdoc
Amazon Linux 2023
0:6.5.0-180.amzn2023.0.4
fixed
ruby3.2-rubygem-rexml
Amazon Linux 2023
0:3.2.5-180.amzn2023.0.4
fixed
ruby3.2-rubygem-rss
Amazon Linux 2023
0:0.2.9-180.amzn2023.0.4
fixed
ruby3.2-rubygem-test-unit
Amazon Linux 2023
0:3.5.7-180.amzn2023.0.4
fixed
ruby3.2-rubygem-typeprof
Amazon Linux 2023
0:0.21.3-180.amzn2023.0.4
fixed
ruby3.2-rubygems
Amazon Linux 2023
0:3.4.10-180.amzn2023.0.4
fixed
ruby3.2-rubygems-devel
Amazon Linux 2023
0:3.4.10-180.amzn2023.0.4
fixed
rubygem-bigdecimal
Amazon Linux 2
0:1.2.0-36.amzn2.0.13
fixed
rubygem-io-console
Amazon Linux 2
0:0.4.2-36.amzn2.0.13
fixed
rubygem-json
Amazon Linux 2
0:1.7.7-36.amzn2.0.13
fixed
rubygem-minitest
Amazon Linux 2
0:4.3.2-36.amzn2.0.13
fixed
rubygem-psych
Amazon Linux 2
0:2.0.0-36.amzn2.0.13
fixed
rubygem-rake
Amazon Linux 2
0:0.9.6-36.amzn2.0.13
fixed
rubygem-rdoc
Amazon Linux 2
0:4.0.0-36.amzn2.0.13
fixed
rubygems
Amazon Linux 2
0:2.0.14.1-36.amzn2.0.13
fixed
rubygems-devel
Amazon Linux 2
0:2.0.14.1-36.amzn2.0.13
fixed
References
https://github.com/ruby/webrick/issues/145
https://github.com/ruby/webrick/issues/145#issuecomment-2369994610
https://github.com/ruby/webrick/issues/145#issuecomment-2372838285
https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841