Bug 2164793 (CVE-2023-22797)

Summary: CVE-2023-22797 rubygem-actionpack: Open Redirect Vulnerability in Action Controller
Product: [Other] Security Response Reporter: ybuenos
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbuckingham, bcourt, btotty, ehelms, jsherril, lzap, mhulan, myarboro, nmoumoul, orabin, pcreech, rchan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: rubygem-actionpack 7.0.4.1 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-01-29 01:52:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2164802    
Bug Blocks: 2162605    

Description ybuenos 2023-01-26 14:14:20 UTC
There is a possible open redirect when using the redirect_to helper with untrusted user input. 

  Vulnerable code will look like this:
  ```
  redirect_to(params[:some_param])
  ```

Rails 7.0 introduced protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could be bypassed by a carefully crafted URL.

Comment 1 ybuenos 2023-01-26 14:25:40 UTC
Created rubygem-actionpack tracking bugs for this issue:

Affects: fedora-all [bug 2164802]

Comment 2 Product Security DevOps Team 2023-01-29 01:52:09 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-22797