ISOMAN

CVE

CVE-2018-8777

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
  2. http://www.securityfocus.com/bid/103683
  3. http://www.securitytracker.com/id/1042004
  4. https://access.redhat.com/errata/RHSA-2018:3729
  5. https://access.redhat.com/errata/RHSA-2018:3730
  6. https://access.redhat.com/errata/RHSA-2018:3731
  7. https://access.redhat.com/errata/RHSA-2019:2028
  8. https://access.redhat.com/errata/RHSA-2020:0542
  9. https://access.redhat.com/errata/RHSA-2020:0591
  10. https://access.redhat.com/errata/RHSA-2020:0663
  11. https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
  12. https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
  13. https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
  14. https://usn.ubuntu.com/3685-1/
  15. https://www.debian.org/security/2018/dsa-4259
  16. https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/
  17. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
  18. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
  19. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
  20. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/