Home > Vulnerability Database > CVE-2021-33621

Mend.io Vulnerability Database

CVE-2021-33621

Good to know:

Date: November 17, 2022

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Language: Ruby

Severity Score

8.8

Related Resources (23)

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/

Url: https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/

Url: https://security.alpinelinux.org/vuln/CVE-2021-33621

Url: https://security.gentoo.org/glsa/202401-27

Url: https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621

Url: https://security-tracker.debian.org/tracker/CVE-2021-33621

Url: https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS/

Url: https://hackerone.com/reports/1204695

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-33621.yml

Url: https://security.netapp.com/advisory/ntap-20221228-0004

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-33621

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD

Url: https://access.redhat.com/security/cve/CVE-2021-33621

Url: https://security.netapp.com/advisory/ntap-20221228-0004/

Url: https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html

Url: https://www.mend.io/vulnerability-database/CVE-2021-33621

Severity Score

8.8

Weakness Type (CWE)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-74

Interpretation Conflict

CWE-436

Top Fix

Upgrade Version

Upgrade to version cgi - 0.1.0.2;cgi - 0.2.2;cgi - 0.3.5

Learn More

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2021-33621

Good to know:

Date: November 17, 2022

Language: Ruby

Severity Score

Related Resources (23)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?