Ruby官网安全更新(2022-11-22)

来源:Ruby官网 发布日期:2022-11-22 阅读次数:13

基本信息

发布日期:2022-11-22(官方当地时间)

更新类型: 安全更新

更新版本: 未知

感知时间:2022-11-22 10:40:04

风险等级: 未知

情报贡献: TSRC

更新标题

CVE-2021-33621: HTTP response splitting in CGI

更新详情

We have released the cgi gem version 0.3.5, 0.2.2, and 0.1.0.2 that has a security fix for a HTTP response splitting vulnerability.
This vulnerability has been assigned the CVE identifier CVE-2021-33621.

Details

If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body.

Also, the contents for a CGI::Cookie object were not checked properly. If an application creates a CGI::Cookie object based on user input, an attacker may exploit it to inject invalid attributes in Set-Cookie header. We think such applications are unlikely, but we have included a change to check arguments for CGI::Cookie#initialize preventatively.

Please update the cgi gem to version 0.3.5, 0.2.2, and 0.1.0.2, or later. You can use gem update cgi to update it.
If you are using bundler, please add gem "cgi", ">= 0.3.5" to your Gemfile.

Affected versions


cgi gem 0.3.3 or before
cgi gem 0.2.1 or before
cgi gem 0.1.1 or 0.1.0.1 or 0.1.0


Credits

Thanks to Hiroshi Tokumaru for discovering this issue.

History


Originally published at 2022-11-22 02:00:00 (UTC)


Posted by mame on 22 Nov 2022

软件描述

Ruby,一种简单快捷的面向对象(面向对象程序设计)脚本语言,在20世纪90年代由日本人松本行弘(Yukihiro Matsumoto)开发,遵守GPL协议和Ruby License.

CVE编号

USRC分析

暂无

业界资讯

暂无