CVE-2021-41816

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-41816

Severity

9.8

Critical

CVSS V3

Description

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

References

https://images.chainguard.dev/security/CGA-rwv5-454x-4xjp
https://github.com/advisories/GHSA-5cqm-crxm-6qpv
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
https://hackerone.com/reports/1328463
https://security-tracker.debian.org/tracker/CVE-2021-41816
https://security.gentoo.org/glsa/202401-27
https://security.netapp.com/advisory/ntap-20220303-0006/
https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CVE-2021-41816

Severity

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company