CVE-2021-33621.yml

---
engine: ruby
cve: 2021-33621
ghsa: vc47-6rqg-c7f5
url: https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
title: HTTP response splitting in CGI
date: 2022-11-22
description: |
  If an application that generates HTTP responses using the cgi gem with
  untrusted user input, an attacker can exploit it to inject a malicious
  HTTP response header and/or body.

  Also, the contents for a CGI::Cookie object were not checked properly. If
  an application creates a CGI::Cookie object based on user input, an
  attacker may exploit it to inject invalid attributes in Set-Cookie header.
  We think such applications are unlikely, but we have included a change
  to check arguments for CGI::Cookie#initialize preventatively.
cvss_v3: 8.8
patched_versions:
  - "~> 2.7.7"
  - "~> 3.0.5"
  - ">= 3.1.3"
related:
  url:
    - https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621
    - https://github.com/advisories/GHSA-vc47-6rqg-c7f5