PT-2022-6734 · Ruby+10 · Cgi+10
Hiroshi Tokumaru
·
Published
2022-09-20
·
Updated
2025-09-29
·
CVE-2021-33621
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
cgi gem versions 0.1.0.0 through 0.1.0.1
cgi gem versions 0.2.0 through 0.2.1
cgi gem versions 0.3.0 through 0.3.4
Description
The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP response header. This allows an attacker to inject malicious content, potentially leading to access to confidential data, disruption of data integrity, and denial of service. The vulnerability is relevant to applications that use the cgi gem to generate HTTP responses or create CGI::Cookie objects based on user input.
Recommendations
For cgi gem version 0.1.0.0 through 0.1.0.1, update to version 0.1.0.2 or later.
For cgi gem version 0.2.0 through 0.2.1, update to version 0.2.2 or later.
For cgi gem version 0.3.0 through 0.3.4, update to version 0.3.5 or later.
As a temporary workaround, consider validating and sanitizing user input before inserting it into HTTP response headers or CGI::Cookie objects to minimize the risk of exploitation.
Exploit
Fix
DoS
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Cgi