CVE-2017-10784

Опубликовано: 19 сент. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 9.3

EPSS Средний

Описание

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

Ссылки

http://www.securityfocus.com/bid/100853
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039363
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1042004
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378
https://access.redhat.com/errata/RHSA-2018:0583
https://access.redhat.com/errata/RHSA-2018:0585
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://security.gentoo.org/glsa/201710-18
https://usn.ubuntu.com/3528-1/
https://usn.ubuntu.com/3685-1/
https://www.debian.org/security/2017/dsa-4031
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
Patch
Vendor Advisory
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
Patch
Vendor Advisory
https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
Vendor Advisory
http://www.securityfocus.com/bid/100853
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039363
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1042004
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*

Версия до 2.2.7 (включая)

cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 97%

0.16412

Средний

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2017-10784

CVSS3: 8.8

ubuntu

почти 9 лет назад

CVE-2017-10784

CVSS3: 5.4

redhat

почти 9 лет назад

CVE-2017-10784

CVSS3: 8.8

debian

почти 9 лет назад

The Basic authentication code in WEBrick library in Ruby before 2.2.8, ...

GHSA-369m-2gv6-mw28

CVSS3: 8.8

github

около 4 лет назад

WEBrick RCE Vulnerability

BDU:2017-02342

CVSS3: 8.8

fstec

около 9 лет назад

Уязвимость функции аутентификации библиотеки WEBrick, позволяющая нарушителю выполнить произвольные команды

EPSS

Процентиль: 97%

0.16412

Средний

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-287