CVE-2020-25613: 
Ruby vulnerability analysis and mitigation

A vulnerability (CVE-2020-25613) was discovered in Ruby's WEBrick, a simple HTTP server bundled with Ruby versions through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. The vulnerability was disclosed on September 29, 2020, and involves WEBrick's insufficient validation of the transfer-encoding header value (Ruby Lang, NVD).

The vulnerability stems from WEBrick's overly permissive handling of the transfer-encoding header value. This implementation weakness is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating a high-severity issue with network accessibility and no required privileges or user interaction (NVD).

The vulnerability could allow an attacker to bypass a reverse proxy (which also has poor header checking), potentially leading to HTTP Request Smuggling attacks. This could result in the addition or modification of data in the system (NetApp Advisory).

The vulnerability is exploitable remotely without requiring authentication or user interaction. Public discussion and proof-of-concept code for this vulnerability has been acknowledged by security vendors (NetApp Advisory).

Users are strongly recommended to update the webrick gem to version 1.6.1 or later. For systems using bundler, adding 'gem "webrick", ">= 1.6.1"' to the Gemfile is recommended. The vulnerability has been fixed in Ruby versions 2.5.9, 2.6.7, and 2.7.2 or later (Ruby Lang).