Vulnerability advisory

GHSA-jmgf-p46x-982h

rails is vulnerable to CRLF injection

Published Oct 24, 2017Updated Apr 9, 2025OSV record ↗

Also known as CVE-2008-5189

Severity

Severity not reported.

Affected versions

rails RubyGems

All rails advisories →

Affected	Fixed in
All versions before 2.0.5	`2.0.5`Advisories →
Also listed as affected (40) `0.10.0` `0.10.1` `0.11.0` `0.11.1` `0.12.0` `0.12.1` `0.13.0` `0.13.1` `0.14.1` `0.14.2` `0.14.3` `0.14.4` `0.8.0` `0.8.5` `0.9.0` `0.9.1` `0.9.2` `0.9.3` `0.9.4` `0.9.4.1` `0.9.5` `1.0.0` `1.1.0` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.1.5` `1.1.6` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.2.6` `2.0.0` `2.0.1` `2.0.2` `2.0.4`

Description

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2008-5189 ↗
Webgithub.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2008-5189.yml ↗
Packagegithub.com/rails/rails ↗
Webgithub.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d ↗
Weblists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html ↗
Webweblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing ↗
Webweblog.rubyonrails.org/2008/10/19/response-splitting-risk ↗