tocsin

Debian/jruby: medium 5.3

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP

Action: Upgrade jruby to 9.3.9.0+ds-1 or later.

Affected

introducedfixedlast affected
09.3.9.0+ds-1-

Fixed versions

9.3.9.0+ds-1

Sources

published · modified · JSON