GitHub Advisoryadvisory · RubyGems

GHSA-fcqf-h4h4-695m actionpack CRLF injection vulnerability

MEDIUM Published 2017-10-24 Modified 2023-07-19 Official page ↗
Aliases
CVE-2011-3186
Ecosystem
RubyGems
Packages
actionpack
Severity
Moderate
Weaknesses
CWE-94
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 2.3.0, < 2.3.13 → fixed in 2.3.13

Description

CRLF injection vulnerability in `actionpack/lib/action_controller/response.rb` in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

Related

Alias · CVE (1)

  • CVE-2011-3186 CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References