CVE-2014-2538

Name of the Vulnerable Software and Affected Versions rack-ssl gem versions prior to 1.4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a URI. This might not be properly handled by third-party adapters such as JRuby-Rack.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/rack/ssl.rb file until a patch is available. Avoid using URIs that might be improperly handled by third-party adapters.