~ / search / GHSA-vc47-6rqg-c7f5

GHSA-vc47-6rqg-c7f5

HTTP response splitting in CGI

Source: GitHub Advisory Database (reviewed) High CVE-2021-33621

Packages

EcosystemPackageAffectedFixed in
RubyGems cgi >= 0.3.0, < 0.3.5 0.3.5
RubyGems cgi >= 0.2.0, < 0.2.2 0.2.2
RubyGems cgi < 0.1.0.2 0.1.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.

References

External links from the advisory. They lead to third-party sites.