GHSA-j24p-r6wx-r79w

High severity vulnerability that affects thin

Source: GitHub Advisory Database (reviewed) High CVE-2009-3287

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	thin	< 1.2.4	1.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-3287 advisory
https://github.com/advisories/GHSA-j24p-r6wx-r79w advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/thin/CVE-2009-3287.yml web
http://github.com/macournoyer/thin package
http://github.com/macournoyer/thin/blob/master/CHANGELOG web
http://github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a web
http://www.openwall.com/lists/oss-security/2009/09/12/1 web