{"id":"UBUNTU-CVE-2021-44528","details":"A open redirect vulnerability exists in Action Pack \u003e= 6.0.0 that could allow an attacker to craft a \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","modified":"2026-05-20T16:05:20.417707829Z","published":"2022-01-10T14:10:00Z","upstream":["CVE-2021-44528"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-44528"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2021/12/14/5"},{"type":"REPORT","url":"https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815"},{"type":"REPORT","url":"https://github.com/rails/rails/commit/aecba3c301b80e9d5a63c30ea1b287bceaf2c107"},{"type":"REPORT","url":"https://github.com/rails/rails/commit/fd6a64fef1d0f7f40a8d4b046da882e83163299c"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-44528"}],"affected":[{"package":{"name":"rails","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/rails?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"rails","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1","binary_name":"ruby-actioncable"},{"binary_name":"ruby-actionmailbox","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_name":"ruby-actionmailer","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1","binary_name":"ruby-actionpack"},{"binary_name":"ruby-actiontext","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_name":"ruby-actionview","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_name":"ruby-activejob","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1","binary_name":"ruby-activemodel"},{"binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1","binary_name":"ruby-activerecord"},{"binary_name":"ruby-activestorage","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_name":"ruby-activesupport","binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1"},{"binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1","binary_name":"ruby-rails"},{"binary_version":"2:6.1.4.1+dfsg-8ubuntu2+esm1","binary_name":"ruby-railties"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44528.json"}},{"package":{"name":"rails","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/rails?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"],"ecosystem_specific":{"binaries":[{"binary_name":"rails","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_name":"ruby-actioncable","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_name":"ruby-actionmailbox","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_name":"ruby-actionmailer","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_version":"2:6.1.7.3+dfsg-3","binary_name":"ruby-actionpack"},{"binary_name":"ruby-actiontext","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_version":"2:6.1.7.3+dfsg-3","binary_name":"ruby-actionview"},{"binary_name":"ruby-activejob","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_name":"ruby-activemodel","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_version":"2:6.1.7.3+dfsg-3","binary_name":"ruby-activerecord"},{"binary_name":"ruby-activestorage","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_name":"ruby-activesupport","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_name":"ruby-rails","binary_version":"2:6.1.7.3+dfsg-3"},{"binary_version":"2:6.1.7.3+dfsg-3","binary_name":"ruby-railties"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44528.json"}},{"package":{"name":"rails","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/rails?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"],"ecosystem_specific":{"binaries":[{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"rails"},{"binary_name":"ruby-actioncable","binary_version":"2:7.2.2.1+dfsg-7"},{"binary_name":"ruby-actionmailbox","binary_version":"2:7.2.2.1+dfsg-7"},{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"ruby-actionmailer"},{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"ruby-actionpack"},{"binary_name":"ruby-actiontext","binary_version":"2:7.2.2.1+dfsg-7"},{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"ruby-actionview"},{"binary_name":"ruby-activejob","binary_version":"2:7.2.2.1+dfsg-7"},{"binary_name":"ruby-activemodel","binary_version":"2:7.2.2.1+dfsg-7"},{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"ruby-activerecord"},{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"ruby-activestorage"},{"binary_version":"2:7.2.2.1+dfsg-7","binary_name":"ruby-activesupport"},{"binary_name":"ruby-rails","binary_version":"2:7.2.2.1+dfsg-7"},{"binary_name":"ruby-railties","binary_version":"2:7.2.2.1+dfsg-7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44528.json"}},{"package":{"name":"rails","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/rails?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"],"ecosystem_specific":{"binaries":[{"binary_name":"rails","binary_version":"2:7.2.3+dfsg-2"},{"binary_version":"2:7.2.3+dfsg-2","binary_name":"ruby-actioncable"},{"binary_version":"2:7.2.3+dfsg-2","binary_name":"ruby-actionmailbox"},{"binary_name":"ruby-actionmailer","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-actionpack","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-actiontext","binary_version":"2:7.2.3+dfsg-2"},{"binary_version":"2:7.2.3+dfsg-2","binary_name":"ruby-actionview"},{"binary_name":"ruby-activejob","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-activemodel","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-activerecord","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-activestorage","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-activesupport","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-rails","binary_version":"2:7.2.3+dfsg-2"},{"binary_name":"ruby-railties","binary_version":"2:7.2.3+dfsg-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44528.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}