1. Home
  2. Security Advisories
  3. Ruby (Gems)
  4. RUBYSEC:CGI-2021-33621

[RUBYSEC:CGI-2021-33621] HTTP response splitting in CGI

Severity High
Affected Packages 1
Fixed Packages 3
CVEs 1
Info Packages References Vulnerabilities

cgi.rb in Ruby through 2.6.x, through 3.0x, and through 3.1.x allows HTTP
header injection. If a CGI application using the CGI library inserts
untrusted input into the HTTP response header, an attacker can exploit it to
insert a newline character to split a header, and inject malicious content to
deceive clients.

Package Affected Version
pkg:gem/cgi < 0.3.5
Package Fixed Version
pkg:gem/cgi = 0.1.0.2
pkg:gem/cgi = 0.2.2
pkg:gem/cgi >= 0.3.5
ID
RUBYSEC:CGI-2021-33621
Severity
high
URL
https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
Published
2022-11-18T00:00:00
(22 months ago)
Modified
2023-05-15T18:05:13
(16 months ago)
Rights
RubySec Security Team
Other Advisories
Source # ID Name URL
Security Advisory GHSA-vc47-6rqg-c7f5 https://github.com/advisories/GHSA-vc47-6rqg-c7f5
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:gem/cgi cgi = 0.1.0.2
Fixed pkg:gem/cgi cgi = 0.2.2
Fixed pkg:gem/cgi cgi >= 0.3.5
Affected pkg:gem/cgi cgi < 0.3.5
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date