Bugzilla Bug 242914

See http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk for a
description of this problem. Currently only 2.0.5 is available as a release.
The page also mentions 2.2.0, but we currently don't have a 2.2.x release in
portage.

Rails 2.0.5 is now in CVS. I propose to test this version for at least a week
before we stable it.

This again [1] is a ruby bug that manifests itself mainly in rails.
Ruby upstream are currently deciding on a patch [2], I expect a decision in the
next few days.

So, ruby would be on the to-do list, too.

[1] similar to bug #236060
[2] http://article.gmane.org/gmane.comp.lang.ruby.core/18709

(In reply to comment #1)
> Rails 2.0.5 is now in CVS. I propose to test this version for at least a week
> before we stable it.

Sounds good.

Rails 2.1.2 is now in CVS.

Rails is all fixed, no more vulnerable versions in the tree, everything stable.

Ruby upstream obviously have no reason to fix this, it didn't even get any
response on the dev ML.
After talking to rbu, we don't want to derivate from upstream and so don't
patch this into Ruby.

So, do we need a GLSA for rails? I'd say NO.

as for me, HTTP response splitting and header injection is mainly a vector
attack and has no security impact by itself, but only together with another
application vulnerability. So, unless there is a serious security issue (code
injection, sql injection, denial of service, privelege escalation) caused by
this bug on a standard application, i would say noglsa.

And i'm rerating to B4 and severity is "Minor" for both B3 and B4.

NO, too. Closing.