Buffer overflow in cgi - CVE-2021-41816

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU58364

Buffer overflow in cgi - CVE-2021-41816

Published: November 25, 2021


Vulnerability identifier: #VU58364
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-41816
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in CGI.escape_html. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

cgi
Gentoo Linux
Ubuntu
Fedora
cflinuxfs3
Red Hat Software Collections
ruby2.7 (Debian package)
rh-ruby27-ruby (Red Hat package)
rh-ruby30-ruby (Red Hat package)
ruby2.3 (Ubuntu package)
ruby2.5 (Ubuntu package)
ruby2.7 (Ubuntu package)
ruby
Netcool Operations Insight

How to mitigate CVE-2021-41816

Install updates from vendor's website.

cgi - addressed in versions 0.1.1, 0.2.1, 0.3.1
cflinuxfs3 - update to 0.272.0
ruby2.7 (Debian package) - update to 2.7.4-1+deb11u1
rh-ruby27-ruby (Red Hat package) - update to 2.7.6-131.el7
rh-ruby30-ruby (Red Hat package) - update to 3.0.4-149.el7
Netcool Operations Insight - update to 1.6.8
ruby2.3 (Ubuntu package) - update to 2.3.12~ubuntu16.04.16+esm3
ruby2.5 (Ubuntu package) - update to 2.5.1-1ubuntu1.11
ruby2.7 (Ubuntu package) - addressed in versions 2.7.0-5ubuntu1.6, 2.7.2-4ubuntu1.3, 2.7.4-1ubuntu3.1
ruby - addressed in versions 3.0.4-153.fc34, 3.0.4-153.fc35

External References

Related Security Bulletins