CVE:CVE-2008-5189
CNNVD:CNNVD-200811-348
Ruby on Rails是Rails团队的一套基于Ruby语言的开源Web应用框架。
Ruby on Rails 2.0.5之前版本中存在CRLF 注入漏洞。远程攻击者可以借助一个特制的对redirect_to函数的URL，诸如任意HTTP文件头和执行HTTP反应分裂攻击。
solution:Upgrade rubyonrails rails to a higher version than 0.9.1,0.9.2,0.9.3,0.9.4,0.9.4.1,0.10.0,0.10.1,0.11.0,0.11.1,0.12.0,0.12.1,0.13.0,0.13.1,0.14.1,0.14.2,0.14.3,0.14.4,1.0.0,1.1.0,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.9.5,2.0.0,2.0.0:rc1,2.0.0:rc2,2.0.1,2.0.2,and avoid the version 0.9.1,0.9.2,0.9.3,0.9.4,0.9.4.1,0.10.0,0.10.1,0.11.0,0.11.1,0.12.0,0.12.1,0.13.0,0.13.1,0.14.1,0.14.2,0.14.3,0.14.4,1.0.0,1.1.0,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.9.5,2.0.0,2.0.0:rc1,2.0.0:rc2,2.0.1,2.0.2; Upgrade rubyonrails ruby_on_rails to a higher version than 2.0.4,0.5.0,0.5.5,0.5.6,0.5.7,0.6.0,0.6.5,0.7.0,0.8.0,0.8.5,0.9.0,and avoid the version (,2.0.4],0.5.0,0.5.5,0.5.6,0.5.7,0.6.0,0.6.5,0.7.0,0.8.0,0.8.5,0.9.0