actionpack CRLF injection vulnerability (GHSA-fcqf-h4h4-695m)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2011-3186
Severity: MODERATE · CWE: CWE-94

CRLF injection vulnerability in `actionpack/lib/action_controller/response.rb` in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

Affected packages:
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.13