En bref
- CVE-2021-41816 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant cgi, cgi (ruby-lang).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.9%, plus élevée que 92.1% des vulnérabilités.
- Correctif : mettre à jour vers 0.2.1, 0.3.1, 0.1.0.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| cgi RubyGems | ≥ 0.2.0, < 0.2.1≥ 0.3.0, < 0.3.1< 0.1.0.1
| 0.2.10.3.10.1.0.1
|
| cgi | ≤ 0.1.0≤ 0.2.0< 0.3.1
| 0.3.1
|
Description
A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.
NVD description
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free