GHSA-vc47-6rqg-c7f5

Source
https://github.com/advisories/GHSA-vc47-6rqg-c7f5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-vc47-6rqg-c7f5/GHSA-vc47-6rqg-c7f5.json
Aliases
Published
2022-11-19T00:30:55Z
Modified
2024-02-21T05:40:46.088667Z
Details

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.

References

Affected packages

RubyGems / cgi

Package

Name
cgi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.3.0
Fixed
0.3.5

Affected versions

0.*

0.3.0
0.3.1
0.3.2
0.3.3
0.3.4

RubyGems / cgi

Package

Name
cgi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.2.0
Fixed
0.2.2

Affected versions

0.*

0.2.0
0.2.1

RubyGems / cgi

Package

Name
cgi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
0.1.0.2

Affected versions

0.*

0.1.0
0.1.0.1