CVE-2023-28362
rails - security update
4.0
MEDIUM
CVSS 3.1
EPSS 0.21%
Description
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
How to fix CVE-2023-28362
To remediate CVE-2023-28362, upgrade the affected package to a fixed version below.
- —upgrade to 2:6.0.3.7+dfsg-2+deb11u3 or later
- —upgrade to 2:6.1.7.10+dfsg-1~deb12u1 or later
- —upgrade to 6.1.7.4 or later
Is CVE-2023-28362 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 2:6.0.3.7+dfsg-2+deb11u3
- from 0, < 2:6.1.7.10+dfsg-1~deb12u1
- from 0, < 6.1.7.4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |