Vulnerability Description
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ruby-Lang | Cgi | < 0.1.0.2 |
| Fedoraproject | Fedora | 35 |
| Ruby-Lang | Ruby | >= 2.7.0, < 2.7.7 |
Related Weaknesses (CWE)
References
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20221228-0004/Third Party Advisory
- https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20221228-0004/Third Party Advisory
- https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-ExploitThird Party Advisory
FAQ
What is CVE-2021-33621?
CVE-2021-33621 is a vulnerability with a CVSS score of 8.8 (HIGH). The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTT...
How severe is CVE-2021-33621?
CVE-2021-33621 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-33621?
Check the references section above for vendor advisories and patch information. Affected products include: Ruby-Lang Cgi, Fedoraproject Fedora, Ruby-Lang Ruby.