DirectorySecurity Advisories
Sign In
Security Advisories

CGA-f527-rqfp-cfc5

Published

Last updated

https://images.chainguard.dev/security/CGA-f527-rqfp-cfc5
Package

ruby3.3-fluentd-kubernetes-daemonset-1.16

Latest Update
Fixed
Fixed Version

1.16.6.1.2-r1

Aliases
  • CVE-2024-47220
  • GHSA-6f62-3596-g6w7

Severity

7.5

High

CVSS V3

Summary

HTTP Request Smuggling in ruby webrick

Description

An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images