|
Vulnerabilities
< Back

CVE-2021-33621

Updated on 18 Nov 2022

Severity

8.8 High severity

Details

CVSS score
8.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Details

Affected product:
AlmaLinux 9.2 ESU , Alpine Linux 3.22 , Debian 11 , Debian 12 , Debian 13 , EL 10 , EL 8 , EL 9 , Ubuntu 22.04 , Ubuntu 24.04
Affected packages:
ruby @ 3.0 (+27 more)
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Fixes