github - GHSA-5cqm-crxm-6qpv

GHSA-5cqm-crxm-6qpv

Vulnerability from github

Published

2021-12-14 21:36

Modified

2022-07-29 14:18

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Buffer overrun in CGI.escape_html

Details

A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "cgi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "cgi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.0"
            },
            {
              "fixed": "0.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "cgi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-14T21:34:08Z",
    "nvd_published_at": "2022-02-06T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (\u003e 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.",
  "id": "GHSA-5cqm-crxm-6qpv",
  "modified": "2022-07-29T14:18:05Z",
  "published": "2021-12-14T21:36:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41816"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby/cgi/commit/959ccf0b6a672bcc64aeaa60c6e1f9e728f1e87f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby/cgi/commit/ad079c1cb5f58eba1ffac46da79995fcf94a3a6e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby/cgi/commit/c6a37a671b556eb06140ea89cc465136b24207a6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruby/cgi/commit/c728632c1c09d46cfd4ecbff9caaa3651dd1002a"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1328463"
    },
    {
      "type": "WEB",
      "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220303-0006"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202401-27"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41816.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ruby/cgi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Buffer overrun in CGI.escape_html"
}

cve-2021-41816

Vulnerability from cvelistv5

Published

2022-02-06 00:00

Modified

2024-08-04 03:22

Severity ?

Summary

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

References

▼	URL	Tags
	https://hackerone.com/reports/1328463
	https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/
	https://security-tracker.debian.org/tracker/CVE-2021-41816
	https://security.netapp.com/advisory/ntap-20220303-0006/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/	vendor-advisory
	https://security.gentoo.org/glsa/202401-27	vendor-advisory

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:22:24.883Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1328463"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220303-0006/"
          },
          {
            "name": "FEDORA-2022-82a9edac27",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"
          },
          {
            "name": "FEDORA-2022-8cf0124add",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"
          },
          {
            "name": "GLSA-202401-27",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-27"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-24T05:06:22.268245",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1328463"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220303-0006/"
        },
        {
          "name": "FEDORA-2022-82a9edac27",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"
        },
        {
          "name": "FEDORA-2022-8cf0124add",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"
        },
        {
          "name": "GLSA-202401-27",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-27"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-41816",
    "datePublished": "2022-02-06T00:00:00",
    "dateReserved": "2021-09-29T00:00:00",
    "dateUpdated": "2024-08-04T03:22:24.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

gsd-2021-41816

Vulnerability from gsd

Modified

2021-11-24 00:00

Details

A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes, typically, Windows. Please update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use `gem update cgi` to update it. If you are using bundler, please add `gem "cgi", ">= 0.3.1"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3. This issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby 2.6 is not vulnerable.

Aliases

CVE-2021-41816

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-41816",
    "description": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.",
    "id": "GSD-2021-41816",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-41816.html",
      "https://www.debian.org/security/2022/dsa-5067",
      "https://ubuntu.com/security/CVE-2021-41816",
      "https://advisories.mageia.org/CVE-2021-41816.html",
      "https://security.archlinux.org/CVE-2021-41816",
      "https://access.redhat.com/errata/RHSA-2022:6855",
      "https://access.redhat.com/errata/RHSA-2022:6856"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "cgi",
            "purl": "pkg:gem/cgi"
          }
        }
      ],
      "aliases": [
        "CVE-2021-41816",
        "GHSA-5cqm-crxm-6qpv"
      ],
      "details": "A security vulnerability that causes buffer overflow when you pass a very large\nstring (\u003e 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes,\ntypically, Windows.\n\nPlease update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use\n`gem update cgi` to update it. If you are using bundler, please add `gem \"cgi\",\n\"\u003e= 0.3.1\"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3.\n\nThis issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby\n2.6 is not vulnerable.",
      "id": "GSD-2021-41816",
      "modified": "2021-11-24T00:00:00.000Z",
      "published": "2021-11-24T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Buffer Overrun in CGI.escape_html"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2021-41816",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/1328463",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1328463"
          },
          {
            "name": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/",
            "refsource": "CONFIRM",
            "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
          },
          {
            "name": "https://security-tracker.debian.org/tracker/CVE-2021-41816",
            "refsource": "MISC",
            "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20220303-0006/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20220303-0006/"
          },
          {
            "name": "FEDORA-2022-82a9edac27",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"
          },
          {
            "name": "FEDORA-2022-8cf0124add",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"
          },
          {
            "name": "GLSA-202401-27",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202401-27"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-41816",
      "cvss_v3": 7.5,
      "date": "2021-11-24",
      "description": "A security vulnerability that causes buffer overflow when you pass a very large\nstring (\u003e 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes,\ntypically, Windows.\n\nPlease update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use\n`gem update cgi` to update it. If you are using bundler, please add `gem \"cgi\",\n\"\u003e= 0.3.1\"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3.\n\nThis issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby\n2.6 is not vulnerable.",
      "gem": "cgi",
      "ghsa": "5cqm-crxm-6qpv",
      "patched_versions": [
        "~\u003e 0.1.0.1",
        "~\u003e 0.1.1",
        "~\u003e 0.2.1",
        "\u003e= 0.3.1"
      ],
      "title": "Buffer Overrun in CGI.escape_html",
      "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=0.3.1",
          "affected_versions": "All versions up to 0.3.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-190",
            "CWE-937"
          ],
          "date": "2022-09-10",
          "description": "`CGI.escape_html` in Ruby has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where `size_t` and `long` have different numbers of bytes.",
          "fixed_versions": [
            "0.3.2"
          ],
          "identifier": "CVE-2021-41816",
          "identifiers": [
            "CVE-2021-41816",
            "GHSA-5cqm-crxm-6qpv",
            "GMS-2021-17"
          ],
          "not_impacted": "All versions after 0.3.1",
          "package_slug": "gem/cgi",
          "pubdate": "2022-02-06",
          "solution": "Upgrade to version 0.3.2 or above.",
          "title": "Integer Overflow or Wraparound",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-41816",
            "https://hackerone.com/reports/1328463",
            "https://security-tracker.debian.org/tracker/CVE-2021-41816",
            "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/",
            "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c",
            "https://github.com/advisories/GHSA-5cqm-crxm-6qpv"
          ],
          "uuid": "86d89a54-991b-4386-854e-c914503cd49f"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions starting from 0.3.0 before 0.3.1, all versions starting from 0.2.0 before 0.2.1, all versions before 0.1.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-12-14",
          "description": "A security vulnerability that causes buffer overflow when you pass a very large string ( MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.\n\nPlease update the cgi gem to,1,1 or later. You can use gem update cgi to update it. If you are using bundler, please add gem \"cgi\", \" \" to your Gemfile. Alternatively, please update Ruby to \n\nThis issue has been introduced since Ruby, so the cgi version bundled with Ruby is not vulnerable.",
          "fixed_versions": [
            "0.3.1",
            "0.1.1",
            "0.1.1"
          ],
          "identifier": "GMS-2021-17",
          "identifiers": [
            "GHSA-5cqm-crxm-6qpv",
            "GMS-2021-17",
            "CVE-2021-41816"
          ],
          "not_impacted": "All versions before 0.3.0, all versions starting from 0.3.1, all versions before 0.2.0, all versions starting from 0.1.1 before 0.2.1",
          "package_slug": "gem/cgi",
          "pubdate": "2021-12-14",
          "solution": "Upgrade to versions 0.3.1, 0.1.1, 0.1.1 or above.",
          "title": "Duplicate of ./gem/cgi/CVE-2021-41816.yml",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-41816",
            "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c",
            "https://github.com/advisories/GHSA-5cqm-crxm-6qpv"
          ],
          "uuid": "420c55bc-5ba3-4576-a641-5ac3d20286cc"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "BDC4A7B5-ED99-4BA3-A016-89134C733059",
                    "versionEndExcluding": "0.3.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D4499575-33A0-47D7-A88B-0E6FD2340792",
                    "versionEndExcluding": "3.0.3",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "D4772765-264E-4A9E-80A8-CA0DFFAB3E11",
                    "versionEndIncluding": "0.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7B53365-0B48-4408-A4A7-9A3744F89F07",
                    "versionEndExcluding": "2.7.5",
                    "versionStartIncluding": "2.7.0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "74619D97-ACF1-4F91-A7D3-50B893FFAEBF",
                    "versionEndIncluding": "0.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby."
          },
          {
            "lang": "es",
            "value": "El archivo CGI.escape_html en Ruby versiones anteriores a 2.7.5 y 3.x versiones anteriores a 3.0.3, presenta un desbordamiento de enteros y un desbordamiento de b\u00fafer resultante por medio de una cadena larga en plataformas (como Windows) donde size_t y long tienen diferentes n\u00fameros de bytes. Esto tambi\u00e9n afecta a CGI gem versiones anteriores a 0.3.1 para Ruby"
          }
        ],
        "id": "CVE-2021-41816",
        "lastModified": "2024-01-24T05:15:11.280",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-02-06T21:15:07.887",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Permissions Required",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/1328463"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://security.gentoo.org/glsa/202401-27"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220303-0006/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

GHSA-5cqm-crxm-6qpv

Vulnerability from github

cve-2021-41816

Vulnerability from cvelistv5

gsd-2021-41816

Vulnerability from gsd

Tags

Sightings

Nomenclature