Skip to content
OpenAdvisories
High ALAS2-2024-2503 1 CVE

Important: ruby security update (Amazon Linux 2)

Published Mar 13, 2024 · Updated Mar 18, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33621: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 ruby-devel 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 ruby-doc 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 ruby-irb 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 ruby-libs 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-36.amzn2.0.8
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-36.amzn2.0.8
Amazon Linux · 2 rubygem-io-console 0:0.4.2-36.amzn2.0.8
Amazon Linux · 2 rubygem-json 0:1.7.7-36.amzn2.0.8
Amazon Linux · 2 rubygem-minitest 0:4.3.2-36.amzn2.0.8
Amazon Linux · 2 rubygem-psych 0:2.0.0-36.amzn2.0.8
Amazon Linux · 2 rubygem-rake 0:0.9.6-36.amzn2.0.8
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-36.amzn2.0.8
Amazon Linux · 2 rubygems 0:2.0.14.1-36.amzn2.0.8
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-36.amzn2.0.8

Vulnerabilities 1

  • High 8.8
    CVE-2021-33621

    HTTP response splitting in CGI

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-33621.html