CVE-2021-33621

Name of the Vulnerable Software and Affected Versions cgi gem versions 0.1.0.0 through 0.1.0.1 cgi gem versions 0.2.0 through 0.2.1 cgi gem versions 0.3.0 through 0.3.4

Description The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP response header. This allows an attacker to inject malicious content, potentially leading to access to confidential data, disruption of data integrity, and denial of service. The vulnerability is relevant to applications that use the cgi gem to generate HTTP responses or create CGI::Cookie objects based on user input.

Recommendations For cgi gem version 0.1.0.0 through 0.1.0.1, update to version 0.1.0.2 or later. For cgi gem version 0.2.0 through 0.2.1, update to version 0.2.2 or later. For cgi gem version 0.3.0 through 0.3.4, update to version 0.3.5 or later. As a temporary workaround, consider validating and sanitizing user input before inserting it into HTTP response headers or CGI::Cookie objects to minimize the risk of exploitation.