REDHAT-BUG-2026752: Buffer Overflow

Published Nov 25, 2021

Updated

A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to CGI.escapehtml on a platform where long type takes 4 bytes, typically, Windows.

Reference: https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escapehtml-cve-2021-41816/

Affected Software

1 affected component

Ruby Ruby

Event History

Nov 25, 2021

Data Sourced

via Red Hat·06:05 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2026752?

The severity of REDHAT-BUG-2026752 is high due to its potential to cause buffer overflow issues.

How do I fix REDHAT-BUG-2026752?

To fix REDHAT-BUG-2026752, it is recommended to apply the latest security patches provided by the Ruby maintainers.

Which versions of Ruby are affected by REDHAT-BUG-2026752?

REDHAT-BUG-2026752 affects Ruby environments where the `CGI.escape_html` method is used and the platform's `long` type is 4 bytes.

Is REDHAT-BUG-2026752 a remote execution vulnerability?

No, REDHAT-BUG-2026752 is not classified as a remote execution vulnerability but rather a buffer overflow issue.

What environments are primarily impacted by REDHAT-BUG-2026752?

REDHAT-BUG-2026752 primarily impacts Windows environments due to the 4-byte long type behavior.