Home > Vulnerability Database > CVE-2021-33621

Mend.io Vulnerability Database

CVE-2021-33621

Good to know:

Date: November 18, 2022

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Language: Ruby

Severity Score

8.8

Related Resources (16)

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2021-33621

Url: https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/

Url: https://security.gentoo.org/glsa/202401-27

Url: https://security-tracker.debian.org/tracker/CVE-2021-33621

Url: https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS/

Url: https://hackerone.com/reports/1204695

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-33621

Url: https://access.redhat.com/security/cve/CVE-2021-33621

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/

Url: https://security.netapp.com/advisory/ntap-20221228-0004/

Url: https://www.mend.io/vulnerability-database/CVE-2021-33621

Severity Score

8.8

Weakness Type (CWE)

Injection

CWE-74

Interpretation Conflict

CWE-436

Top Fix

Upgrade Version

Upgrade to version cgi - 0.1.0.2,0.2.2,0.3.5

Learn More

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2021-33621

Good to know:

Date: November 18, 2022

Language: Ruby

Severity Score

Related Resources (16)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?