What’s Vulnerable › Vulnerabilities

CVE-2017-17742

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-03 · updated 2026-06-17
• Weakness: CWE-113

Description

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Affected products

• Debian Linux: 7.0
• Ruby: from 2.2.0 before 2.2.10; from 2.3.0 before 2.3.7; from 2.4.0 before 2.4.4; from 2.5.0 before 2.5.1; 2.6.0-preview1 — fixed in 2.2.10, 2.3.7, 2.4.4, 2.5.1

How to fix

Upgrade to a fixed version: Ruby 2.2.10, 2.3.7, 2.4.4, 2.5.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
• http://www.securityfocus.com/bid/103684
• http://www.securitytracker.com/id/1042004
• https://access.redhat.com/errata/RHSA-2018:3729
• https://access.redhat.com/errata/RHSA-2018:3730
• https://access.redhat.com/errata/RHSA-2018:3731
• https://access.redhat.com/errata/RHSA-2019:2028
• https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
• https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
• https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
• https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html

Get alerted when CVE-2017-17742 or the next vulnerability affects your stack