Contents

---
engine: ruby
cve: 2017-10784
url: https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
title: Escape sequence injection vulnerability in the Basic authentication of WEBrick
date: 2017-09-14
description: |
  There is an escape sequence injection vulnerability in the Basic
  authentication of WEBrick bundled by Ruby.


  When using the Basic authentication of WEBrick, clients can pass an
  arbitrary string as the user name. WEBrick outputs the passed user name
  intact to its log, then an attacker can inject malicious escape sequences to
  the log and dangerous control characters may be executed on a victim’s
  terminal emulator.

  This vulnerability is similar to a vulnerability already fixed, but it had
  not been fixed in the Basic authentication.

  All users running an affected release should upgrade immediately.
patched_versions:
  - "~> 2.2.8"
  - "~> 2.3.5"
  - ">= 2.4.2"

Version data entries

3 entries across 3 versions & 2 rubygems

Version	Path
bundler-audit-0.7.0.1	data/ruby-advisory-db/rubies/ruby/CVE-2017-10784.yml
bundler-budit-0.6.2	data/ruby-advisory-db/rubies/ruby/CVE-2017-10784.yml
bundler-budit-0.6.1	data/ruby-advisory-db/rubies/ruby/CVE-2017-10784.yml