NetSight
IP …
high8.8

CVE-2021-33621

HTTP response splitting in CGI

Impact

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.

Affected packages

EcosystemPackageAffectedFixed in
rubygemscgi>= 0.3.0, < 0.3.50.3.5

Affected products

VendorProductAffected versions
Ruby-LangCgi
before 0.1.0.2
from 0.2.0 before 0.2.2
from 0.3.0 before 0.3.5
FedoraprojectFedora
Versions 35, 36, 37
Ruby-LangRuby
from 2.7.0 before 2.7.7
from 3.0.0 before 3.0.5
from 3.1.0 before 3.1.3

Weakness classification

CWE-74CWE-436

References