gsd-2021-41816
Vulnerability from gsd
Modified
2021-11-24 00:00
Details
A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes, typically, Windows. Please update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use `gem update cgi` to update it. If you are using bundler, please add `gem "cgi", ">= 0.3.1"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3. This issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby 2.6 is not vulnerable.
Aliases
Aliases
CVE-2021-41816


To clipboard 

{
  "GSD": {
    "alias": "CVE-2021-41816",
    "description": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.",
    "id": "GSD-2021-41816",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-41816.html",
      "https://www.debian.org/security/2022/dsa-5067",
      "https://ubuntu.com/security/CVE-2021-41816",
      "https://advisories.mageia.org/CVE-2021-41816.html",
      "https://security.archlinux.org/CVE-2021-41816",
      "https://access.redhat.com/errata/RHSA-2022:6855",
      "https://access.redhat.com/errata/RHSA-2022:6856"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "cgi",
            "purl": "pkg:gem/cgi"
          }
        }
      ],
      "aliases": [
        "CVE-2021-41816",
        "GHSA-5cqm-crxm-6qpv"
      ],
      "details": "A security vulnerability that causes buffer overflow when you pass a very large\nstring (\u003e 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes,\ntypically, Windows.\n\nPlease update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use\n`gem update cgi` to update it. If you are using bundler, please add `gem \"cgi\",\n\"\u003e= 0.3.1\"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3.\n\nThis issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby\n2.6 is not vulnerable.",
      "id": "GSD-2021-41816",
      "modified": "2021-11-24T00:00:00.000Z",
      "published": "2021-11-24T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Buffer Overrun in CGI.escape_html"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2021-41816",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/1328463",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1328463"
          },
          {
            "name": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/",
            "refsource": "CONFIRM",
            "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
          },
          {
            "name": "https://security-tracker.debian.org/tracker/CVE-2021-41816",
            "refsource": "MISC",
            "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20220303-0006/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20220303-0006/"
          },
          {
            "name": "FEDORA-2022-82a9edac27",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"
          },
          {
            "name": "FEDORA-2022-8cf0124add",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"
          },
          {
            "name": "GLSA-202401-27",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202401-27"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-41816",
      "cvss_v3": 7.5,
      "date": "2021-11-24",
      "description": "A security vulnerability that causes buffer overflow when you pass a very large\nstring (\u003e 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes,\ntypically, Windows.\n\nPlease update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use\n`gem update cgi` to update it. If you are using bundler, please add `gem \"cgi\",\n\"\u003e= 0.3.1\"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3.\n\nThis issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby\n2.6 is not vulnerable.",
      "gem": "cgi",
      "ghsa": "5cqm-crxm-6qpv",
      "patched_versions": [
        "~\u003e 0.1.0.1",
        "~\u003e 0.1.1",
        "~\u003e 0.2.1",
        "\u003e= 0.3.1"
      ],
      "title": "Buffer Overrun in CGI.escape_html",
      "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=0.3.1",
          "affected_versions": "All versions up to 0.3.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-190",
            "CWE-937"
          ],
          "date": "2022-09-10",
          "description": "`CGI.escape_html` in Ruby has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where `size_t` and `long` have different numbers of bytes.",
          "fixed_versions": [
            "0.3.2"
          ],
          "identifier": "CVE-2021-41816",
          "identifiers": [
            "CVE-2021-41816",
            "GHSA-5cqm-crxm-6qpv",
            "GMS-2021-17"
          ],
          "not_impacted": "All versions after 0.3.1",
          "package_slug": "gem/cgi",
          "pubdate": "2022-02-06",
          "solution": "Upgrade to version 0.3.2 or above.",
          "title": "Integer Overflow or Wraparound",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-41816",
            "https://hackerone.com/reports/1328463",
            "https://security-tracker.debian.org/tracker/CVE-2021-41816",
            "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/",
            "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c",
            "https://github.com/advisories/GHSA-5cqm-crxm-6qpv"
          ],
          "uuid": "86d89a54-991b-4386-854e-c914503cd49f"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions starting from 0.3.0 before 0.3.1, all versions starting from 0.2.0 before 0.2.1, all versions before 0.1.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-12-14",
          "description": "A security vulnerability that causes buffer overflow when you pass a very large string ( MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.\n\nPlease update the cgi gem to,1,1 or later. You can use gem update cgi to update it. If you are using bundler, please add gem \"cgi\", \" \" to your Gemfile. Alternatively, please update Ruby to \n\nThis issue has been introduced since Ruby, so the cgi version bundled with Ruby is not vulnerable.",
          "fixed_versions": [
            "0.3.1",
            "0.1.1",
            "0.1.1"
          ],
          "identifier": "GMS-2021-17",
          "identifiers": [
            "GHSA-5cqm-crxm-6qpv",
            "GMS-2021-17",
            "CVE-2021-41816"
          ],
          "not_impacted": "All versions before 0.3.0, all versions starting from 0.3.1, all versions before 0.2.0, all versions starting from 0.1.1 before 0.2.1",
          "package_slug": "gem/cgi",
          "pubdate": "2021-12-14",
          "solution": "Upgrade to versions 0.3.1, 0.1.1, 0.1.1 or above.",
          "title": "Duplicate of ./gem/cgi/CVE-2021-41816.yml",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-41816",
            "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c",
            "https://github.com/advisories/GHSA-5cqm-crxm-6qpv"
          ],
          "uuid": "420c55bc-5ba3-4576-a641-5ac3d20286cc"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "BDC4A7B5-ED99-4BA3-A016-89134C733059",
                    "versionEndExcluding": "0.3.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D4499575-33A0-47D7-A88B-0E6FD2340792",
                    "versionEndExcluding": "3.0.3",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "D4772765-264E-4A9E-80A8-CA0DFFAB3E11",
                    "versionEndIncluding": "0.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7B53365-0B48-4408-A4A7-9A3744F89F07",
                    "versionEndExcluding": "2.7.5",
                    "versionStartIncluding": "2.7.0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "74619D97-ACF1-4F91-A7D3-50B893FFAEBF",
                    "versionEndIncluding": "0.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby."
          },
          {
            "lang": "es",
            "value": "El archivo CGI.escape_html en Ruby versiones anteriores a 2.7.5 y 3.x versiones anteriores a 3.0.3, presenta un desbordamiento de enteros y un desbordamiento de b\u00fafer resultante por medio de una cadena larga en plataformas (como Windows) donde size_t y long tienen diferentes n\u00fameros de bytes. Esto tambi\u00e9n afecta a CGI gem versiones anteriores a 0.3.1 para Ruby"
          }
        ],
        "id": "CVE-2021-41816",
        "lastModified": "2024-01-24T05:15:11.280",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-02-06T21:15:07.887",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Permissions Required",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/1328463"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://security.gentoo.org/glsa/202401-27"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220303-0006/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.