CVE-2021-41816

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

Bundler sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. (CVE-2020-36327)

The REXML gem does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. (CVE-2021-28965)

In RDoc it is possible to execute arbitrary code via | and tags in a filename. (CVE-2021-31799)

A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

Ruby Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." (CVE-2021-32066)

Buffer Overrun in CGI.escape_html (CVE-2021-41816)

Regular Expression Denial of Service Vulnerability of Date Parsing Methods (CVE-2021-41817)

Cookie Prefix Spoofing in CGI::Cookie.parse (CVE-2021-41819)

These are all security issues fixed in the libruby2_7-2_7-2.7.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_0-3_0-3.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_1-3_1-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_2-3_2-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_3-3_3-3.3.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_4-3_4-3.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby4_0-4_0-4.0.0~preview2-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Ruby incorrectly handled certain HTML files. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. (CVE-2021-41816)

It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a regular expression denial of service. (CVE-2021-41817)

It was discovered that Ruby incorrectly handled certain cookie names. An attacker could possibly use this issue to access or expose sensitive information. (CVE-2021-41819)