VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
249bc4cebedade5155d8eeefbac7a00eae5d85bc
vuln-cve/data/2019/16xxx/CVE-2019-16254.json
T

263 lines
11 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"state": "PUBLISHED",
"cveId": "CVE-2019-16254",
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"dateUpdated": "2024-08-05T01:10:41.699Z",
"dateReserved": "2019-09-11T00:00:00.000Z",
"datePublished": "2019-11-26T00:00:00.000Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre",
"dateUpdated": "2023-04-30T00:00:00.000Z"
},
"descriptions": [
{
"lang": "en",
"value": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF."
}
],
"affected": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"version": "n/a",
"status": "affected"
}
]
}
],
"references": [
{
"url": "https://hackerone.com/reports/331984"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/"
},
{
"name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
},
{
"name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
"tags": [
"mailing-list"
],
"url": "https://seclists.org/bugtraq/2019/Dec/31"
},
{
"name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
"tags": [
"mailing-list"
],
"url": "https://seclists.org/bugtraq/2019/Dec/32"
},
{
"name": "DSA-4587",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2019/dsa-4587"
},
{
"name": "DSA-4586",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2019/dsa-4586"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "GLSA-202003-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202003-06"
},
{
"name": "openSUSE-SU-2020:0395",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
},
{
"name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
}
],
"problemTypes": [
{
"descriptions": [
{
"type": "text",
"lang": "en",
"description": "n/a"
}
]
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-05T01:10:41.699Z"
},
"title": "CVE Program Container",
"references": [
{
"url": "https://hackerone.com/reports/331984",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html",
"tags": [
"x_transferred"
]
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/",
"tags": [
"x_transferred"
]
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/",
"tags": [
"x_transferred"
]
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/",
"tags": [
"x_transferred"
]
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/",
"tags": [
"x_transferred"
]
},
{
"name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
},
{
"name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Dec/31"
},
{
"name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Dec/32"
},
{
"name": "DSA-4587",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2019/dsa-4587"
},
{
"name": "DSA-4586",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2019/dsa-4586"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"tags": [
"x_transferred"
]
},
{
"name": "GLSA-202003-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-06"
},
{
"name": "openSUSE-SU-2020:0395",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
},
{
"name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
},
{
"name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
}
]
}
]
}
}
View Git Blame Copy Permalink