p PatchFirst

CVE-2021-41816

CVE-2021-41816

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

CVSS 9.8 · Critical · EPSS 4.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ruby2.7 Debian:11

    Versions
    • 2.7.4-1
    Affected ranges
    • ECOSYSTEM: < 2.7.4-1+deb11u1

    Update to 2.7.4-1+deb11u1

  • ruby2.7 Ubuntu:20.04:LTS

    Versions
    • 2.7.0-1
    • 2.7.0-2
    • 2.7.0-3
    • 2.7.0-4
    • 2.7.0-4ubuntu1
    • 2.7.0-5ubuntu1
    • 2.7.0-5ubuntu1.1
    • 2.7.0-5ubuntu1.2
    • 2.7.0-5ubuntu1.3
    • 2.7.0-5ubuntu1.4
    • 2.7.0-5ubuntu1.5
    Affected ranges
    • ECOSYSTEM: < 2.7.0-5ubuntu1.6

    Update to 2.7.0-5ubuntu1.6

  • ruby3.0 Ubuntu:22.04:LTS

    Versions
    • 3.0.2-5ubuntu1
    • 3.0.2-7
    Affected ranges
    • ECOSYSTEM: < 3.0.2-7ubuntu2

    Update to 3.0.2-7ubuntu2

Original sources

Check your server →