CVE-2025-25184

A flaw was found in the rubygem-rack package. When a user provides the authorization credentials via Rack::Auth::Basic, if successful, the username is placed in env['REMOTE_USER'] and later used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username containing CRLF and white space characters or the server logs every login attempt. If an attacker enters a username with a CRLF character, the logger will log the malicious username with CRLF characters into the logfile. This flaw allows attackers to break log formats or insert fraudulent entries, potentially obscuring activity or injecting malicious data into log files.

A moderate-impact log injection flaw was found in the rubygem-rack package, which ships in Red Hat Enterprise Linux 9 (the pcs component and the ruby-30, ruby-31, and ruby-33 container images) and is used by other Red Hat offerings, including Red Hat Satellite 6, Red Hat 3scale API Management Platform 2, OpenShift Logging, Red Hat Insights, and Hosted OpenShift, as well as Fedora and EPEL community streams. When a user authenticates via Rack::Auth::Basic, the supplied username is stored in the request environment and later written to the log file by Rack::CommonLogger. If an application allows usernames containing carriage return and line feed (CRLF) or other whitespace characters, or logs every login attempt, an attacker who controls such a username can inject forged entries into the log file, breaking log formats, obscuring real activity, or inserting malicious data into log files. The impact is limited to the integrity of log data: Red Hat and NIST both rate this flaw Moderate with a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), in line with the upstream CVSS 4.0 score of 5.7, also Moderate. Red Hat Enterprise Linux 10 is not affected because the vulnerable code is not present in that release. For the affected Red Hat Enterprise Linux 9 components and other delegated product and community streams, fixes are being pursued by the respective maintainers; for Red Hat 3scale API Management Platform 2 the maintainers decided not to fix the issue. For Red Hat Satellite 6.16 and 6.17 and the Red Hat Insights compliance-backend the fix is deferred, and the residual risk is limited to manipulation of log content by an authenticated user, with no direct impact on confidentiality or availability of the system itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.