Skip to content
OpenAdvisories
High USN-5806-1 1 CVE

ruby2.3 vulnerability

Published Jan 17, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Hiroshi Tokumaru discovered that Ruby did not properly handle certain
user input for applications which generate HTTP responses using cgi gem.
An attacker could possibly use this issue to maliciously modify the
response a user would receive from a vulnerable application.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby2.3 2.3.1-2~ubuntu16.04.16+esm4

Vulnerabilities 1

  • High 8.8
    CVE-2021-33621

    HTTP response splitting in CGI

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2021-33621