CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before
    2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    attacks via the Content-Type header. (CVE-2011-3186)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cross-site scripting (XSS) vulnerability in the strip_tags helper in
    actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x
    before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML
    via a tag with an invalid name. (CVE-2011-2931)

  - CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before
    2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    attacks via the Content-Type header. (CVE-2011-3186)

The remote host is affected by the vulnerability described in GLSA-201412-28 (Ruby on Rails: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Ruby on Rails. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code or cause a Denial of       Service condition. Furthermore, a remote attacker may be able to execute       arbitrary SQL commands, change parameter names for form inputs and make       changes to arbitrary records in the system, bypass intended access       restrictions, render arbitrary views, inject arbitrary web script or       HTML, or conduct cross-site request forgery (CSRF) attacks.
  Workaround :

    There is no known workaround at this time.

This update of rails fixes the following security issues :

CVE-2011-2930 - SQL-injection in quote_table_name function via specially crafted column names (bnc#712062) CVE-2011-2931 - Cross-Site Scripting (XSS) in the strip_tags helper (bnc#712057) CVE-2011-3186 - Response Splitting (bnc#712058) CVE-2010-3933 - Arbitrary modification of records via specially crafted form parameters (bnc#712058) CVE-2011-0446 - Cross-Site Scripting (XSS) in the mail_to helper (bnc#668817) CVE-2011-0447 - Improper validation of 'X-Requested-With' header (bnc#668817) CVE-2011-0448 - SQL-injection caused by improperly sanitized arguments to the limit function (bnc#668817) CVE-2011-0449 - Bypass of access restrictions via specially crafted action names (bnc#668817)

fixes for BZs #731436, #732156

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Rails, the Ruby web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4214     A cross-site scripting (XSS) vulnerability had been     found in the strip_tags function. An attacker may inject     non-printable characters that certain browsers will then     evaluate. This vulnerability only affects the oldstable     distribution (lenny).

  - CVE-2011-2930     A SQL injection vulnerability had been found in the     quote_table_name method that could allow malicious users     to inject arbitrary SQL into a query.

  - CVE-2011-2931     A cross-site scripting (XSS) vulnerability had been     found in the strip_tags helper. An parsing error can be     exploited by an attacker, who can confuse the parser and     may inject HTML tags into the output document.

  - CVE-2011-3186     A newline (CRLF) injection vulnerability had been found     in response.rb. This vulnerability allows an attacker to     inject arbitrary HTTP headers and conduct HTTP response     splitting attacks via the Content-Type header.

ID	Name	Product	Family	Type	Severity
423169	SCA: security update for actionpack (GHSA-fcqf-h4h4-695m)	Tenable Cloud Security	SCA Checks	Local	medium
423169	SCA: security update for actionpack (GHSA-fcqf-h4h4-695m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
401338	Alpine: ruby-actionpack: security update to 2.3.11-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401338	Alpine: ruby-actionpack: security update to 2.3.11-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
79981	GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
76016	openSUSE Security Update : rubygem-actionmailer (openSUSE-SU-2011:1305-1)	Nessus	SuSE Local Security Checks	Local	high
75730	openSUSE Security Update : rubygem-actionmailer (openSUSE-SU-2011:1305-1)	Nessus	SuSE Local Security Checks	Local	high
56098	Fedora 14 : rubygem-actionpack-2.3.8-4.fc14 (2011-11567)	Nessus	Fedora Local Security Checks	Local	medium
56074	Debian DSA-2301-2 : rails - several vulnerabilities	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2011-3186

medium

Tenable Plugins

medium

medium

critical

critical

critical

high

high

medium

high