CVE-2008-5189 rails is vulnerable to CRLF injection
MediumCVSS 5.0
EPSS 1.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rails(RubyGems) | < 2.0.5 | 2.0.5 |
| rubygems rails(RubyGems) | = 0.10.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.10.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.11.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.11.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.12.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.12.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.13.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.13.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.2 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.3 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.4 | No fix listed |
| rubygems rails(RubyGems) | = 0.8.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.8.5 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.2 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.3 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.4 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.4.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.5 | No fix listed |
| rubygems rails(RubyGems) | = 1.0.0 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.0 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.1 | No fix listed |
Show 68 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rails(RubyGems) | = 1.1.2 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.3 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.4 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.5 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.6 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.0 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.1 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.2 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.3 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.4 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.5 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.6 | No fix listed |
| rubygems rails(RubyGems) | = 2.0.0 | No fix listed |
| rubygems rails(RubyGems) | = 2.0.1 | No fix listed |
| rubygems rails(RubyGems) | = 2.0.2 | No fix listed |
| rubygems rails(RubyGems) | = 2.0.4 | No fix listed |
| rubyonrails rails | = 0.9.1 | No fix listed |
| rubyonrails rails | = 0.9.2 | No fix listed |
| rubyonrails rails | = 0.9.3 | No fix listed |
| rubyonrails rails | = 0.9.4 | No fix listed |
| rubyonrails rails | = 0.9.4.1 | No fix listed |
| rubyonrails rails | = 0.10.0 | No fix listed |
| rubyonrails rails | = 0.10.1 | No fix listed |
| rubyonrails rails | = 0.11.0 | No fix listed |
| rubyonrails rails | = 0.11.1 | No fix listed |
| rubyonrails rails | = 0.12.0 | No fix listed |
| rubyonrails rails | = 0.12.1 | No fix listed |
| rubyonrails rails | = 0.13.0 | No fix listed |
| rubyonrails rails | = 0.13.1 | No fix listed |
| rubyonrails rails | = 0.14.1 | No fix listed |
| rubyonrails rails | = 0.14.2 | No fix listed |
| rubyonrails rails | = 0.14.3 | No fix listed |
| rubyonrails rails | = 0.14.4 | No fix listed |
| rubyonrails rails | = 1.0.0 | No fix listed |
| rubyonrails rails | = 1.1.0 | No fix listed |
| rubyonrails rails | = 1.1.1 | No fix listed |
| rubyonrails rails | = 1.1.2 | No fix listed |
| rubyonrails rails | = 1.1.3 | No fix listed |
| rubyonrails rails | = 1.1.4 | No fix listed |
| rubyonrails rails | = 1.1.5 | No fix listed |
| rubyonrails rails | = 1.1.6 | No fix listed |
| rubyonrails rails | = 1.2.0 | No fix listed |
| rubyonrails rails | = 1.2.1 | No fix listed |
| rubyonrails rails | = 1.2.2 | No fix listed |
| rubyonrails rails | = 1.2.3 | No fix listed |
| rubyonrails rails | = 1.2.4 | No fix listed |
| rubyonrails rails | = 1.2.5 | No fix listed |
| rubyonrails rails | = 1.2.6 | No fix listed |
| rubyonrails rails | = 1.9.5 | No fix listed |
| rubyonrails rails | = 2.0.0 | No fix listed |
| rubyonrails rails | = 2.0.0-rc1 | No fix listed |
| rubyonrails rails | = 2.0.0-rc2 | No fix listed |
| rubyonrails rails | = 2.0.1 | No fix listed |
| rubyonrails rails | = 2.0.2 | No fix listed |
| rubyonrails ruby on rails | <= 2.0.4 | No fix listed |
| rubyonrails ruby on rails | = 0.5.0 | No fix listed |
| rubyonrails ruby on rails | = 0.5.5 | No fix listed |
| rubyonrails ruby on rails | = 0.5.6 | No fix listed |
| rubyonrails ruby on rails | = 0.5.7 | No fix listed |
| rubyonrails ruby on rails | = 0.6.0 | No fix listed |
| rubyonrails ruby on rails | = 0.6.5 | No fix listed |
| rubyonrails ruby on rails | = 0.7.0 | No fix listed |
| rubyonrails ruby on rails | = 0.8.0 | No fix listed |
| rubyonrails ruby on rails | = 0.8.5 | No fix listed |
| rubyonrails ruby on rails | = 0.9.0 | No fix listed |
| debian/rails(Debian:12) | < 2.1.0-6 | 2.1.0-6 |
| debian/rails(Debian:13) | < 2.1.0-6 | 2.1.0-6 |
| debian/rails(Debian:14) | < 2.1.0-6 | 2.1.0-6 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com product
- github.com patch
- SUSE-SR:2008:027 vendor-advisory
- weblog.rubyonrails.org vendor-advisory
- weblog.rubyonrails.org
- 32359 patch vdb-entry
- Debian Security Tracker CVE-2008-5189 vendor-advisory
- github.com