#VU8448 Information disclosure in RubyGems - CVE-2017-10784
Published: September 15, 2017
Vulnerability identifier: #VU8448
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-10784
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
RubyGems
RubyGems
Software vendor:
Ruby
Ruby
Description
The vulnerability allows a remote attacker to cause DoS condition or obtain potentially sensitive information on the target system.
The weakness exists due to escape sequence injection vulnerability in the Basic authentication of WEBrick. A remote attacker can supply a specially crafted user name value to the WEBrick Basic authentication function, inject escape sequence into the log file and view log contents.
Successful exploitation of the vulnerability results in information disclosure or denial of service.
The weakness exists due to escape sequence injection vulnerability in the Basic authentication of WEBrick. A remote attacker can supply a specially crafted user name value to the WEBrick Basic authentication function, inject escape sequence into the log file and view log contents.
Successful exploitation of the vulnerability results in information disclosure or denial of service.
Remediation
Update to version 2.2.8 or 2.3.5.