Skip to content
OpenAdvisories
High RHSA-2024:4542 1 CVE

Red Hat Security Advisory: ruby security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 29

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby-debuginfo 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby-debugsource 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby-default-gems 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby-devel 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby-libs 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream ruby-libs-debuginfo 0:3.0.4-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-bigdecimal 0:3.0.0-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-bigdecimal-debuginfo 0:3.0.0-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-bundler 0:2.2.33-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-io-console 0:0.5.7-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-io-console-debuginfo 0:0.5.7-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-irb 0:1.3.5-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-json 0:2.5.1-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-json-debuginfo 0:2.5.1-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-minitest 0:5.14.2-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-power_assert 0:1.2.0-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-psych 0:3.3.2-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-psych-debuginfo 0:3.3.2-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-rake 0:13.0.3-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-rbs 0:1.4.0-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-rdoc 0:6.3.3-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-rexml 0:3.2.5-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-rss 0:0.2.9-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-test-unit 0:3.3.7-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygem-typeprof 0:0.15.2-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygems 0:3.2.33-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream rubygems-devel 0:3.2.33-161.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb ruby-doc 0:3.0.4-161.el9_2.1

Vulnerabilities 1

  • High 8.8
    CVE-2021-33621

    HTTP response splitting in CGI

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2149706
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4542.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-33621
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-33621
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-33621