CVE-2008-5189

描述

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

如何修補 CVE-2008-5189

要修補 CVE-2008-5189,請將受影響套件升級到下列已修補版本。

• Debian/rails—升級至 2.1.0-6 或更新版本
• RubyGems/rails—升級至 2.0.5 或更新版本

CVE-2008-5189 正在被利用嗎?

低 — EPSS 為 1.5%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 2.1.0-6
• from 0, < 2.0.5

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2008-5189
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2008-5189
• PATCHgithub.com/rails/rails
• WEBgithub.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d
• WEB