~ / search / GHSA-5cqm-crxm-6qpv

GHSA-5cqm-crxm-6qpv

Buffer overrun in CGI.escape_html

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41816

Packages

EcosystemPackageAffectedFixed in
RubyGems cgi >= 0.3.0, < 0.3.1 0.3.1
RubyGems cgi >= 0.2.0, < 0.2.1 0.2.1
RubyGems cgi < 0.1.0.1 0.1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.

References

External links from the advisory. They lead to third-party sites.