CVE-2021-41816
Publication date 2 December 2021
Last updated 25 August 2025
Ubuntu priority
Description
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ruby2.7 | ||
| 20.04 LTS focal |
Fixed 2.7.0-5ubuntu1.6
|
|
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Ignored end of standard support | |
| ruby3.0 | 22.04 LTS jammy |
Fixed 3.0.2-7ubuntu2
|
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Ignored end of standard support | |
| ruby2.3 | 16.04 LTS xenial |
Not affected
|
| 14.04 LTS trusty | Ignored end of standard support | |
| ruby2.5 | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Ignored end of standard support |
Notes
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-5235-1
- Ruby vulnerabilities
- 18 January 2022