| Package | Affected versions | Patched versions |
|---|---|---|
| ruby | = 1.8.7= 1.9.2 |
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free