Package Instance

Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication
Regular expression denial of service vulnerability of WEBrick’s Digest
authentication module was found. An attacker can exploit this vulnerability
to cause an effective denial of service against a WEBrick service.

A code injection vulnerability of Shell#[] and Shell#test
Shell#[] and its alias Shell#test defined in lib/shell.rb allow code
injection if the first argument (aka the “command” argument) is untrusted
data. An attacker can exploit this to call an arbitrary Ruby method.

Note that passing untrusted data to methods of Shell is dangerous in general.
Users must never do it. However, we treat this particular case as a
vulnerability because the purpose of Shell#[] and Shell#[] is considered file
testing.

HTTP response splitting in WEBrick (Additional fix)
If a program using WEBrick inserts untrusted input into the response header,
an attacker can exploit it to insert a newline character to split a header,
and inject malicious content to deceive clients.

This is the same issue as CVE-2017-17742. The previous fix was incomplete,
which addressed the CRLF vector, but did not address an isolated CR or an
isolated LF.

A NUL injection vulnerability of File.fnmatch and File.fnmatch?
Built-in methods File.fnmatch and its alias File.fnmatch? accept the path
pattern as their first parameter. When the pattern contains NUL character
(\0), the methods recognize that the path pattern ends immediately before the
NUL byte. Therefore, a script that uses an external input as the pattern
argument, an attacker can make it wrongly match a pathname that is the second
parameter.