Most recent entries from all

ALSA-2023:3821 — Moderate: ruby:2.7 security, bug fix, and enhancement update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc and 21 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465)

Security Fix(es):

* ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-03834

Withdrawn: BELL-CVE-2021-33621 — CVE-2021-33621 does not affect BellSoft software

Withdrawn by the publisher.

BIT-ruby-2021-33621

Affected: Bitnami: ruby

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

certfr-2023-avi-0318 — De multiples vulnérabilités ont été découvertes dans VMware. Elles permettent à un attaquan…

certfr-2023-avi-0318

CLEANSTART-2026-JL84667 — Security fix for CVE-2021-33621 applied in: ruby 3.1.3-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-258775

fkie_cve-2021-33621

GHSA-vc47-6rqg-c7f5 — HTTP response splitting in CGI

Affected: RubyGems: cgi

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.

gsd-2021-33621

OESA-2023-1003 — ruby security update

Affected: openEuler:20.03-LTS-SP1: ruby, openEuler:20.03-LTS-SP3: ruby, openEuler:22.03-LTS: ruby, openEuler:22.03-LTS-SP1: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es): The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.(CVE-2021-33621)

openSUSE-SU-2024:12539-1 — libruby3_1-3_1-3.1.3-1.1 on GA media

libruby3_1-3_1-3.1.3-1.1 on GA media

RHSA-2023:3291 — Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update

ruby/cgi-gem: HTTP response splitting in CGI ruby: ReDoS vulnerability in URI ruby: ReDoS vulnerability in Time

UBUNTU-CVE-2021-33621

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:25.10: jruby and 1 more

WID-SEC-W-2022-2173 — Ruby: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um Dateien zu manipulieren.