Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47220: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ruby3.2 | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-bundled-gems | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-bundled-gems-debuginfo | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-debuginfo | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-debugsource | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-default-gems | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-devel | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-doc | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-libs | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-libs-debuginfo | 0:3.2.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-bigdecimal | 0:3.1.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-bigdecimal-debuginfo | 0:3.1.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-bundler | 0:2.4.10-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-io-console | 0:0.6.0-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-io-console-debuginfo | 0:0.6.0-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-irb | 0:1.6.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-json | 0:2.6.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-json-debuginfo | 0:2.6.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-minitest | 0:5.16.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-power_assert | 0:2.0.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-psych | 0:5.0.1-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-psych-debuginfo | 0:5.0.1-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-rake | 0:13.0.6-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-rbs | 0:2.8.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-rbs-debuginfo | 0:2.8.2-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-rdoc | 0:6.5.0-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-rexml | 0:3.2.5-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-rss | 0:0.2.9-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-test-unit | 0:3.5.7-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygem-typeprof | 0:0.21.3-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygems | 0:3.4.10-180.amzn2023.0.4 |
| Amazon Linux · 2023 | ruby3.2-rubygems-devel | 0:3.4.10-180.amzn2023.0.4 |
Vulnerabilities 1
-
High 7.5CVE-2024-47220 Rejected
HTTP Request Smuggling in ruby webrick
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-47220.html