CRLF injection in Rack - CVE-2025-25184

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU105794

CRLF injection in Rack - CVE-2025-25184

Published: March 17, 2025


Vulnerability identifier: #VU105794
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-25184
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to manipulate data log entries.

The vulnerability exists due to insufficient validation of attacker-supplied data in Rack::CommonLogger. A remote user can pass specially crafted authorization credentials containing CR-LF characters to the Rack::Auth::Basic method, which stores this info into the to the env['REMOTE_USER'] variable. If the application accepts CR-LF characters in user name, a remote user can manipulate data log entries.


Affected software

Rack
Debian Linux
SUSE Enterprise Server 15 SP3 Business Critical
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Ubuntu
openSUSE Leap
openEuler
Fedora
IBM License Metric Tool
ruby-rack (Ubuntu package)
ruby2.5-rubygem-rack-1_6
ruby2.5-rubygem-rack-testsuite-1_6
ruby2.5-rubygem-rack-doc-1_6
ruby2.5-rubygem-rack
ruby2.5-rubygem-rack-testsuite
ruby2.5-rubygem-rack-doc
rubygem-rack
rubygem-rack-help
ruby-rack (Debian package)
OpenShift Logging

How to mitigate CVE-2025-25184

Install updates from vendor's website.

Rack - addressed in versions 2.2.11, 3.0.12, 3.1.11
IBM License Metric Tool - update to 9.2.39
ruby-rack (Ubuntu package) - addressed in versions Ubuntu Pro, 2.2.7-1ubuntu0.2, 2.2.7-1.1ubuntu0.1, 2.2.7-1.1ubuntu0.25.04.2
ruby2.5-rubygem-rack-1_6 - update to 1.6.8-150000.3.3.1
ruby2.5-rubygem-rack-testsuite-1_6 - update to 1.6.8-150000.3.3.1
ruby2.5-rubygem-rack-doc-1_6 - update to 1.6.8-150000.3.3.1
ruby2.5-rubygem-rack - update to 2.0.8-150000.3.26.1
ruby2.5-rubygem-rack-testsuite - update to 2.0.8-150000.3.26.1
ruby2.5-rubygem-rack-doc - update to 2.0.8-150000.3.26.1
rubygem-rack - update to 2.2.3.1-7
rubygem-rack-help - update to 2.2.3.1-7
ruby-rack (Debian package) - update to 2.2.13-1~deb12u1
rubygem-rack - addressed in versions 2.2.21-1.fc41, 2.2.21-9.fc42
OpenShift Logging - update to 5.9.12

External References

Related Security Bulletins