diff --git a/advisories/unreviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json b/advisories/github-reviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json similarity index 61% rename from advisories/unreviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json rename to advisories/github-reviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json index c46a6ebbb8b..3243a72ab75 100644 --- a/advisories/unreviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json +++ b/advisories/github-reviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-6f62-3596-g6w7", - "modified": "2024-09-23T18:30:34Z", + "modified": "2024-09-23T20:43:55Z", "published": "2024-09-22T03:30:30Z", "aliases": [ "CVE-2024-47220" ], + "summary": "HTTP Request Smuggling in ruby webrick", "details": "An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "RubyGems", + "name": "webrick" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.8.1" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +47,14 @@ { "type": "WEB", "url": "https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ruby/webrick" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-444" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-23T20:43:55Z", "nvd_published_at": "2024-09-22T01:15:11Z" } } \ No newline at end of file