CVE-2021-33621

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.(CVE-2021-33621)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

• ruby: ReDoS vulnerability in URI (CVE-2023-28755)

• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

• ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

• ruby: ReDoS vulnerability in URI (CVE-2023-28755)

• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-29052)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

• ruby: ReDoS vulnerability in URI (CVE-2023-28755)

• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (Rocky Linux-29048)

• ruby: Ruby cannot read private key in FIPS mode on Rocky Linux 9 (Rocky Linux-12437)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (AlmaLinux-28565)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-28569)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (AlmaLinux-29052)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-29048)
• ruby: Ruby cannot read private key in FIPS mode on AlmaLinux 9 (AlmaLinux-12437)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)
• ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
• ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
• ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.0). (AlmaLinux-35740)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)
• ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
• ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
• ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body.

Also, the contents for a CGI::Cookie object were not checked properly. If an application creates a CGI::Cookie object based on user input, an attacker may exploit it to inject invalid attributes in Set-Cookie header. Such applications are unlikely, but a change is included to check arguments for CGI::Cookie#initialize preventatively.

These are all security issues fixed in the libruby3_1-3_1-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-28565)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

• ruby: ReDoS vulnerability in URI (CVE-2023-28755)

• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (Rocky Linux-28569)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for ruby2.5 fixes the following issues:

• CVE-2023-28755: Fixed a ReDoS vulnerability in URI. (bsc#1209891)
• CVE-2023-28756: Fixed an expensive regexp in the RFC2822 time parser. (bsc#1209967)
• CVE-2021-41817: Fixed a Regular Expression Denial of Service Vulnerability of Date Parsing Methods. (bsc#1193035)
• CVE-2021-33621: Fixed a HTTP response splitting vulnerability in CGI gem. (bsc#1205726)

Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application.

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10.

Original advisory details:

Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application.

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 20.04 LTS.

Original advisory details:

Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application.