CVE-2021-41816
Fixed in a distro release EPSS 5%
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
Products: ruby-lang cgi, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | cgi | 0.3.1 |
| RubyGems | cgi | 0.2.1 |
| RubyGems | cgi | 0.1.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.12 | ruby | 2.7.5-r0 |
| Alpine 3.13 | ruby | 2.7.5-r0 |
| Alpine 3.14 | ruby | 2.7.5-r0 |
| Alpine 3.15 | ruby | 3.0.3-r0 |
| Alpine 3.16 | ruby | 3.0.3-r0 |
| Alpine 3.17 | ruby | 3.0.3-r0 |
| Alpine 3.18 | ruby | 3.0.3-r0 |
| Alpine 3.19 | ruby | 3.0.3-r0 |
| Alpine 3.20 | ruby | 3.0.3-r0 |
| Alpine 3.21 | ruby | 3.0.3-r0 |
| Alpine 3.22 | ruby | 3.0.3-r0 |
| Alpine 3.23 | ruby | 3.0.3-r0 |
| Alpine 3.24 | ruby | 3.0.3-r0 |
| Debian 11 | ruby2.7 | 2.7.4-1+deb11u1 |
| Red Hat rhel software collections 3 | rh-ruby27-ruby | 0:2.7.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-ruby-debuginfo | 0:2.7.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-ruby-devel | 0:2.7.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-ruby-doc | 0:2.7.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-ruby-libs | 0:2.7.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-bigdecimal | 0:2.0.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-bundler | 0:2.2.24-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-did_you_mean | 0:1.4.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-io-console | 0:0.5.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-irb | 0:1.2.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-json | 0:2.3.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-minitest | 0:5.13.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-net-telnet | 0:0.2.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-openssl | 0:2.1.3-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-power_assert | 0:1.1.7-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-psych | 0:3.1.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-racc | 0:1.4.16-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-rake | 0:13.0.1-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-rdoc | 0:6.2.1.1-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-test-unit | 0:3.3.4-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygem-xmlrpc | 0:0.3.0-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygems | 0:3.1.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby27-rubygems-devel | 0:3.1.6-131.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-ruby | 0:3.0.4-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-ruby-debuginfo | 0:3.0.4-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-ruby-default-gems | 0:3.0.4-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-ruby-devel | 0:3.0.4-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-ruby-doc | 0:3.0.4-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-ruby-libs | 0:3.0.4-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-bigdecimal | 0:3.0.0-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-bundler | 0:2.2.33-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-io-console | 0:0.5.7-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-irb | 0:1.3.5-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-json | 0:2.5.1-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-minitest | 0:5.14.2-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-power_assert | 0:1.2.0-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-psych | 0:3.3.2-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-rake | 0:13.0.3-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-rbs | 0:1.4.0-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-rexml | 0:3.2.5-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-rss | 0:0.2.9-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-test-unit | 0:3.3.7-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygem-typeprof | 0:0.15.2-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygems | 0:3.2.33-149.el7 |
| Red Hat rhel software collections 3 | rh-ruby30-rubygems-devel | 0:3.2.33-149.el7 |
| Ubuntu 18.04 LTS | ruby2.5 | 2.5.1-1ubuntu1.11 |
| Ubuntu 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.6 |
| Ubuntu 22.04 LTS | ruby3.0 | 3.0.2-7ubuntu2 |
| Ubuntu Pro 16.04 LTS | ruby2.3 | 2.3.1-2~ubuntu16.04.16+esm2 |
| openSUSE Tumbleweed | ruby2.7 | 2.7.5-1.1 |
| openSUSE Tumbleweed | ruby3.0 | 3.0.3-1.1 |
| openSUSE Tumbleweed | ruby3.1 | 3.1.0-1.1 |
| openSUSE Tumbleweed | ruby3.2 | 3.2.1-1.1 |
| openSUSE Tumbleweed | ruby3.3 | 3.3.0-1.2 |
| openSUSE Tumbleweed | ruby3.4 | 3.4.1-1.1 |
| openSUSE Tumbleweed | ruby4.0 | 4.0.0~preview2-1.1 |