Em resumo
- CVE-2021-41816 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta cgi, cgi (ruby-lang).
- Chance de exploração nos próximos 30 dias (EPSS): 4.9%, maior que 92.1% das vulnerabilidades.
- Correção: atualize para 0.2.1, 0.3.1, 0.1.0.1 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| cgi RubyGems | ≥ 0.2.0, < 0.2.1≥ 0.3.0, < 0.3.1< 0.1.0.1
| 0.2.10.3.10.1.0.1
|
| cgi | ≤ 0.1.0≤ 0.2.0< 0.3.1
| 0.3.1
|
Description
A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.
NVD description
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free