High
Security advisory
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-10784
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:49 UTC · Revision 1
Source evidence
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
osv:CVE-2017-10784
Complete source record
{
"id": "2e1d1c7fbc37ffc323871cac610d63b89c2dd55c3ea1b434101e85cce694ce3c",
"url": "https://osv.dev/vulnerability/CVE-2017-10784",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-10784",
"summary": "The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.",
"evidence": "osv:CVE-2017-10784",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-10784",
"aliases": [
"CVE-2017-10784",
"GHSA-369m-2gv6-mw28"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ruby/ruby",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "530165c2948c3eed741db5659f7b937270caa46a"
},
{
"introduced": "d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20"
},
{
"last_affected": "820605ba3c10b9f4dafc4e5d6e09765b8b31cbea"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.2.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"last_affected": "2.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.0-preview1"
},
{
"last_affected": "2.3.0-preview1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.0-preview2"
},
{
"last_affected": "2.3.0-preview2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.1"
},
{
"last_affected": "2.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.2"
},
{
"last_affected": "2.3.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.3"
},
{
"last_affected": "2.3.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.4"
},
{
"last_affected": "2.3.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.0-preview1"
},
{
"last_affected": "2.4.0-preview1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.0-preview2"
},
{
"last_affected": "2.4.0-preview2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.0-preview3"
},
{
"last_affected": "2.4.0-preview3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.0-rc1"
},
{
"last_affected": "2.4.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.1"
},
{
"last_affected": "2.4.1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.3.0",
"2.3.0-preview1",
"2.3.0-preview2",
"2.3.1",
"2.3.2",
"2.3.3",
"2.3.4",
"2.4.0",
"2.4.0-preview1",
"2.4.0-preview2",
"2.4.0-preview3",
"2.4.0-rc1",
"2.4.1",
"v2_2_7",
"v2_4_1",
"v2_2_0_rc1",
"v1_0_r2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-10784.json"
}
}
],
"modified": "2026-10-24T10:30:45.004381061Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html",
"https://usn.ubuntu.com/3528-1/",
"https://usn.ubuntu.com/3685-1/",
"https://access.redhat.com/errata/RHSA-2017:3485",
"https://access.redhat.com/errata/RHSA-2018:0378",
"https://access.redhat.com/errata/RHSA-2018:0583",
"https://access.redhat.com/errata/RHSA-2018:0585",
"https://security.gentoo.org/glsa/201710-18",
"https://www.debian.org/security/2017/dsa-4031",
"https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/",
"https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/",
"https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-10784",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436024,
"published_at": "2017-09-19T17:29:00.263+00:00"
}