CVE-2021-33621
Publication date 18 November 2022
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
Status
Package | Ubuntu Release | Status |
---|---|---|
jruby | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty |
Needs evaluation
|
|
ruby1.9.1 | ||
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored end of standard support | |
ruby2.0 | ||
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored end of standard support | |
ruby2.3 | ||
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Fixed 2.3.1-2~ubuntu16.04.16+esm4
|
|
14.04 LTS trusty | Not in release | |
ruby2.5 | ||
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Fixed 2.5.1-1ubuntu1.13
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
ruby2.7 | ||
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Fixed 2.7.0-5ubuntu1.8
|
|
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
ruby3.0 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Fixed 3.0.2-7ubuntu2.3
|
|
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
ruby3.1 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProPatch details
Package | Patch details |
---|---|
ruby2.3 |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.8 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-5806-1
- Ruby vulnerability
- 17 January 2023
- USN-5806-2
- Ruby vulnerability
- 23 January 2023
- USN-5806-3
- Ruby vulnerability
- 20 March 2023
- USN-6181-1
- Ruby vulnerabilities
- 21 June 2023