Ruby-lang CVEs and Security Vulnerabilities

CVE-2011-4121

extension): Insecure way of creation exponent value by private RSA key generation

The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed

Vendors

Ruby-lang

Products

Ruby

CVE-2011-3624

WEBrick:: HTTPRequest X-Forwarded-* allows arbitrary data

Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed