The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers...
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2021-22881 rails Corrigé dans: 2:6.0.3.5+dfsg-1
- Ubuntu UBUNTU-CVE-2021-22881 rails
Description d'origine La description telle que publiée par la source (souvent en anglais).
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory openwall.com
- advisory openwall.com
- patch openwall.com
- patch benjamin-bouchet.com
- patch discuss.rubyonrails.org
- patch hackerone.com
- web lists.fedoraproject.org