{"action":"Upgrade webrick to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"webrick","cve_ids":["CVE-2017-10784"],"ecosystem":"RubyGems","epss":0.16412,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-369m-2gv6-mw28","id":"tcs_01M5KEG7TWMX2YWMY0X4M1HPRH","modified_at":"2024-03-13T05:20:04.843043Z","published_at":"2022-05-14T02:03:29Z","references":["https://osv.dev/vulnerability/GHSA-369m-2gv6-mw28","https://nvd.nist.gov/vuln/detail/CVE-2017-10784","https://github.com/ruby/ruby/commit/6617c41292","https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813","https://hackerone.com/reports/223363","https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784","https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released","https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released","https://www.debian.org/security/2017/dsa-4031","https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363","https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004","https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853","https://usn.ubuntu.com/3685-1","https://usn.ubuntu.com/3528-1","https://security.gentoo.org/glsa/201710-18","https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml","https://github.com/ruby/webrick","https://access.redhat.com/errata/RHSA-2018:0585","https://access.redhat.com/errata/RHSA-2018:0583","https://access.redhat.com/errata/RHSA-2018:0378","https://access.redhat.com/errata/RHSA-2017:3485"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-369m-2gv6-mw28","url":"https://osv.dev/vulnerability/GHSA-369m-2gv6-mw28"}],"summary":"WEBrick RCE Vulnerability"}