Candidate: CVE-2021-44528
PublicDate: 2022-01-10 14:10:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
 https://www.openwall.com/lists/oss-security/2021/12/14/5
 https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815 (master)
 https://github.com/rails/rails/commit/aecba3c301b80e9d5a63c30ea1b287bceaf2c107 (v6.1.4.2)
 https://github.com/rails/rails/commit/fd6a64fef1d0f7f40a8d4b046da882e83163299c (v6.0.4.2)
Description:
 A open redirect vulnerability exists in Action Pack >= 6.0.0 that could
 allow an attacker to craft a "X-Forwarded-Host" headers in combination with
 certain "allowed host" formats can cause the Host Authorization middleware
 in Action Pack to redirect users to a malicious website.
Ubuntu-Description:
Notes:
 seth-arnold> In Oneiric-Saucy, rails package is just for transition;
 seth-arnold> The rails package contains actual code from vivid onward
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]

Patches_rails:
upstream_rails: needs-triage
trusty_rails: ignored (out of standard support)
trusty/esm_rails: DNE
xenial_rails: not-affected (code not present)
bionic_rails: not-affected (code not present)
focal_rails: not-affected (code not present)
hirsute_rails: ignored (reached end-of-life)
impish_rails: needed
jammy_rails: needed
devel_rails: needed

Patches_ruby-rails-3.2:
upstream_ruby-rails-3.2: needs-triage
trusty_ruby-rails-3.2: ignored (out of standard support)
trusty/esm_ruby-rails-3.2: DNE
xenial_ruby-rails-3.2: DNE
bionic_ruby-rails-3.2: DNE
focal_ruby-rails-3.2: DNE
hirsute_ruby-rails-3.2: DNE
impish_ruby-rails-3.2: DNE
jammy_ruby-rails-3.2: DNE
devel_ruby-rails-3.2: DNE

Patches_ruby-actionpack-3.2:
upstream_ruby-actionpack-3.2: needs-triage
trusty_ruby-actionpack-3.2: ignored (out of standard support)
trusty/esm_ruby-actionpack-3.2: DNE
xenial_ruby-actionpack-3.2: DNE
bionic_ruby-actionpack-3.2: DNE
focal_ruby-actionpack-3.2: DNE
hirsute_ruby-actionpack-3.2: DNE
impish_ruby-actionpack-3.2: DNE
jammy_ruby-actionpack-3.2: DNE
devel_ruby-actionpack-3.2: DNE

Patches_ruby-activesupport-3.2:
upstream_ruby-activesupport-3.2: needs-triage
trusty_ruby-activesupport-3.2: ignored (out of standard support)
trusty/esm_ruby-activesupport-3.2: DNE
xenial_ruby-activesupport-3.2: DNE
bionic_ruby-activesupport-3.2: DNE
focal_ruby-activesupport-3.2: DNE
hirsute_ruby-activesupport-3.2: DNE
impish_ruby-activesupport-3.2: DNE
jammy_ruby-activesupport-3.2: DNE
devel_ruby-activesupport-3.2: DNE

Patches_ruby-activerecord-3.2:
upstream_ruby-activerecord-3.2: needs-triage
trusty_ruby-activerecord-3.2: ignored (out of standard support)
trusty/esm_ruby-activerecord-3.2: DNE
xenial_ruby-activerecord-3.2: DNE
bionic_ruby-activerecord-3.2: DNE
focal_ruby-activerecord-3.2: DNE
hirsute_ruby-activerecord-3.2: DNE
impish_ruby-activerecord-3.2: DNE
jammy_ruby-activerecord-3.2: DNE
devel_ruby-activerecord-3.2: DNE

Patches_ruby-activemodel-3.2:
upstream_ruby-activemodel-3.2: needs-triage
trusty_ruby-activemodel-3.2: ignored (out of standard support)
trusty/esm_ruby-activemodel-3.2: DNE
xenial_ruby-activemodel-3.2: DNE
bionic_ruby-activemodel-3.2: DNE
focal_ruby-activemodel-3.2: DNE
hirsute_ruby-activemodel-3.2: DNE
impish_ruby-activemodel-3.2: DNE
jammy_ruby-activemodel-3.2: DNE
devel_ruby-activemodel-3.2: DNE

Patches_rails-4.0:
upstream_rails-4.0: needs-triage
trusty_rails-4.0: ignored (out of standard support)
trusty/esm_rails-4.0: DNE
xenial_rails-4.0: DNE
bionic_rails-4.0: DNE
focal_rails-4.0: DNE
hirsute_rails-4.0: DNE
impish_rails-4.0: DNE
jammy_rails-4.0: DNE
devel_rails-4.0: DNE