CVE-2011-3187

Description

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

How to fix CVE-2011-3187

To remediate CVE-2011-3187, upgrade the affected package to a fixed version below.

• Debian/rails—no fix listed
• RubyGems/actionpack—upgrade to 2.3.13 or later

Is CVE-2011-3187 being exploited?

Moderate — EPSS is 8.5%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (2)

• from 0
• >= 2.3.0, < 2.3.13

References (13)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2011-3187
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2011-3187
• PATCHgithub.com/rails/rails
• WEBbugzilla.novell.com/show_bug.cgi?id=673010
• WEB