Bug 2034266 (CVE-2021-44528)

Summary:	CVE-2021-44528 rubygem-actionpack: specially crafted "X-Forwarded-Host" headers may lead to open redirect
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbuckingham, bcourt, btotty, ehelms, jaruga, jsherril, lzap, mhulan, mmccune, mo, myarboro, nmoumoul, orabin, pcreech, pvalena, rchan, ruby-packagers-sig, sseago, strzibny, vondruch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rubygem-actionpack 6.1.4.2, rubygem-actionpack 6.0.4.2, rubygem-actionpack 7.0.0.rc2	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-20 15:49:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2034268
Bug Blocks:	2034269

Description Marian Rehak 2021-12-20 14:29:55 UTC

Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Reference:

https://www.openwall.com/lists/oss-security/2021/12/14/5

Comment 1 Marian Rehak 2021-12-20 14:35:10 UTC

Created rubygem-actionpack tracking bugs for this issue:

Affects: fedora-all [bug 2034268]

Comment 2 Yadnyawalk Tale 2021-12-20 15:12:10 UTC

Changelog:
https://github.com/rails/rails/blob/v6.1.4.2/actionpack/CHANGELOG.md#rails-6142-december-14-2021

Upstream patch:
https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815

Comment 3 Product Security DevOps Team 2021-12-20 15:49:50 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-44528