CVE-2020-25613
mediumPriorität · verfolgen · 41EPSS 0.038 · 90. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (1)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- metapox/CVE-2020-25613metapox/CVE-2020-25613PoC · poc_in_github
betroffene Produkte (39)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-1109Ruby: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2020-09-28csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-gwfg-cqmg-cf8fWEBRick vulnerable to HTTP Request/Response Smuggling2022-05-24ghsa · osvUS
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
- BIT-ruby-2020-256132024-03-06vendor · osvUS
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
- BIT-ruby-min-2020-256132025-01-27vendor · osvUS
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202009-1672cnnvd
- EUVD-2022-4026enisa_euvd
- BDU:2021-01472fstec_bdu
- GHSA-gwfg-cqmg-cf8fenisa_euvd
- BIT-ruby-2020-25613osv
- BIT-ruby-min-2020-25613osv
- GHSA-gwfg-cqmg-cf8fosv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (45)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2020-25613cnnvd
- https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7cnnvd
- https://hackerone.com/reports/965267cnnvd
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-25613cnnvd
- https://packetstormsecurity.com/files/161870/Ubuntu-Security-Notice-USN-4882-1.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan