GHSA SYNC: 1 brand new advisory

jasnow · postmodern · commit 561272afec19 · 2025-06-28T06:15:10.000-07:00
diff --git a/gems/webrick/CVE-2025-6442.yml b/gems/webrick/CVE-2025-6442.yml
@@ -0,0 +1,29 @@
+---
+gem: webrick
+cve: 2025-6442
+ghsa: r995-q44h-hr64
+url: https://github.com/advisories/GHSA-r995-q44h-hr64
+title: Ruby WEBrick read_headers method can lead to
+  HTTP Request/Response Smuggling
+date: 2025-06-26
+description: |
+  Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
+
+  This vulnerability allows remote attackers to smuggle arbitrary HTTP
+  requests on affected installations of Ruby WEBrick. This issue is
+  exploitable when the product is deployed behind an HTTP proxy that
+  fulfills specific conditions.
+
+  The specific flaw exists within the read_headers method. The issue
+  results from the inconsistent parsing of terminators of HTTP headers.
+  An attacker can leverage this vulnerability to smuggle arbitrary
+  HTTP requests. Was ZDI-CAN-21876.
+cvss_v3: 6.5
+patched_versions:
+  - ">= 1.8.2"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6442
+    - https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-414
+    - https://github.com/advisories/GHSA-r995-q44h-hr64
