rails is vulnerable to CRLF injection (GHSA-jmgf-p46x-982h)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2008-5189
Severity: MODERATE · CWE: CWE-352

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

Affected packages:
package: ecosystem: RubyGems
name: rails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.5