| Package | Affected versions | Patched versions |
|---|---|---|
| cgi | ≥ 0.2.0, < 0.2.2≥ 0.3.0, < 0.3.5< 0.1.0.2 | 0.2.20.3.50.1.0.2 |
| cgi | ≥ 0.2.0, < 0.2.2≥ 0.3.0, < 0.3.5< 0.1.0.2 | 0.2.20.3.50.1.0.2 |
| ruby | ≥ 2.7.0, < 2.7.7≥ 3.0.0, < 3.0.5≥ 3.1.0, < 3.1.3 | 2.7.73.0.53.1.3 |
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free