CVE-2024-47220

Publication date 22 September 2024

Last updated 8 October 2024

Ubuntu priority

Medium

Why this priority?

An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."

Read the notes from the security team

Status

Package Ubuntu Release Status
ruby-webrick 24.10 oracular
Fixed 1.8.1-1ubuntu1
24.04 LTS noble
Fixed 1.8.1-1ubuntu0.1
22.04 LTS jammy
Fixed 1.7.0-3ubuntu0.1
20.04 LTS focal Not in release

Notes

mdeslaur

webrick should not be used in production

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
ruby-webrick

References

Related Ubuntu Security Notices (USN)

Other references