CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

• CWE-287

• http://www.securityfocus.com/bid/100853Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039363Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1042004
• https://access.redhat.com/errata/RHSA-2017:3485
• https://access.redhat.com/errata/RHSA-2018:0378
• https://access.redhat.com/errata/RHSA-2018:0583
• https://access.redhat.com/errata/RHSA-2018:0585
• https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
• https://security.gentoo.org/glsa/201710-18
• https://usn.ubuntu.com/3528-1/
• https://usn.ubuntu.com/3685-1/
• https://www.debian.org/security/2017/dsa-4031
• https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/Patch, Vendor Advisory
• https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/Patch, Vendor Advisory
• https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/Vendor Advisory
• http://www.securityfocus.com/bid/100853Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039363Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1042004
• https://access.redhat.com/errata/RHSA-2017:3485
• https://access.redhat.com/errata/RHSA-2018:0378
• https://access.redhat.com/errata/RHSA-2018:0583
• https://access.redhat.com/errata/RHSA-2018:0585
• https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
• https://security.gentoo.org/glsa/201710-18
• https://usn.ubuntu.com/3528-1/
• https://usn.ubuntu.com/3685-1/
• https://www.debian.org/security/2017/dsa-4031
• https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/Patch, Vendor Advisory
• https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/Patch, Vendor Advisory
• https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/Vendor Advisory

Published

Sep 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-10779XnView Classic for Windows Version 2.40 might allow attacker…
• CVE-2017-1078Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-10780XnView Classic for Windows Version 2.40 might allow attacker…
• CVE-2017-10781XnView Classic for Windows Version 2.40 might allow attacker…
• CVE-2017-10782XnView Classic for Windows Version 2.40 might allow attacker…
• CVE-2017-10783XnView Classic for Windows Version 2.40 might allow attacker…
• CVE-2017-10788The DBD::mysql module through 4.043 for Perl allows remote a…
• CVE-2017-10789The DBD::mysql module through 4.043 for Perl uses the mysql_…
• CVE-2017-1079Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-10790The _asn1_check_identifier function in GNU Libtasn1 through …
• CVE-2017-10791There is an Integer overflow in the hash_int function of the…
• CVE-2017-10792There is a NULL Pointer Dereference in the function ll_inser…