Skip to content

Commit 9ffb2cf

Browse files
riseshiariseshia
committed
Copy news from en
1 parent e2de8b4 commit 9ffb2cf

4 files changed

+190
-0
lines changed

‎ko/news/_posts/2022-11-22-http-response-splitting-in-cgi-cve-2021-33621.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2021-33621: HTTP response splitting in CGI"
4+
author: "mame"
5+
translator:
6+
date: 2022-11-22 02:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
We have released the cgi gem version 0.3.5, 0.2.2, and 0.1.0.2 that has a security fix for a HTTP response splitting vulnerability.
12+
This vulnerability has been assigned the CVE identifier [CVE-2021-33621](https://nvd.nist.gov/vuln/detail/CVE-2021-33621).
13+
14+
## Details
15+
16+
If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body.
17+
18+
Also, the contents for a `CGI::Cookie` object were not checked properly. If an application creates a `CGI::Cookie` object based on user input, an attacker may exploit it to inject invalid attributes in `Set-Cookie` header. We think such applications are unlikely, but we have included a change to check arguments for `CGI::Cookie#initialize` preventatively.
19+
20+
Please update the cgi gem to version 0.3.5, 0.2.2, and 0.1.0.2, or later. You can use `gem update cgi` to update it.
21+
If you are using bundler, please add `gem "cgi", ">= 0.3.5"` to your `Gemfile`.
22+
23+
## Affected versions
24+
25+
* cgi gem 0.3.3 or before
26+
* cgi gem 0.2.1 or before
27+
* cgi gem 0.1.1 or 0.1.0.1 or 0.1.0
28+
29+
## Credits
30+
31+
Thanks to [Hiroshi Tokumaru](https://hackerone.com/htokumaru?type=user) for discovering this issue.
32+
33+
## History
34+
35+
* Originally published at 2022-11-22 02:00:00 (UTC)

‎ko/news/_posts/2022-11-24-ruby-2-7-7-released.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.7.7 Released"
4+
author: "usa"
5+
translator:
6+
date: 2022-11-24 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.7.7 has been released.
11+
12+
This release includes a security fix.
13+
Please check the topics below for details.
14+
15+
* [CVE-2021-33621: HTTP response splitting in CGI]({%link en/news/_posts/2022-11-22-http-response-splitting-in-cgi-cve-2021-33621.md %})
16+
17+
This release also includes some build problem fixes. They are not considered to affect compatibility with previous versions.
18+
See the [commit logs](https://github.com/ruby/ruby/compare/v2_7_6...v2_7_7) for further details.
19+
20+
## Download
21+
22+
{% assign release = site.data.releases | where: "version", "2.7.7" | first %}
23+
24+
* <{{ release.url.bz2 }}>
25+
26+
SIZE: {{ release.size.bz2 }}
27+
SHA1: {{ release.sha1.bz2 }}
28+
SHA256: {{ release.sha256.bz2 }}
29+
SHA512: {{ release.sha512.bz2 }}
30+
31+
* <{{ release.url.gz }}>
32+
33+
SIZE: {{ release.size.gz }}
34+
SHA1: {{ release.sha1.gz }}
35+
SHA256: {{ release.sha256.gz }}
36+
SHA512: {{ release.sha512.gz }}
37+
38+
* <{{ release.url.xz }}>
39+
40+
SIZE: {{ release.size.xz }}
41+
SHA1: {{ release.sha1.xz }}
42+
SHA256: {{ release.sha256.xz }}
43+
SHA512: {{ release.sha512.xz }}
44+
45+
* <{{ release.url.zip }}>
46+
47+
SIZE: {{ release.size.zip }}
48+
SHA1: {{ release.sha1.zip }}
49+
SHA256: {{ release.sha256.zip }}
50+
SHA512: {{ release.sha512.zip }}
51+
52+
## Release Comment
53+
54+
Many committers, developers, and users who provided bug reports helped us make this release.
55+
Thanks for their contributions.

‎ko/news/_posts/2022-11-24-ruby-3-0-5-released.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.0.5 Released"
4+
author: "usa"
5+
translator:
6+
date: 2022-11-24 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.0.5 has been released.
11+
12+
This release includes a security fix.
13+
Please check the topics below for details.
14+
15+
* [CVE-2021-33621: HTTP response splitting in CGI]({%link en/news/_posts/2022-11-22-http-response-splitting-in-cgi-cve-2021-33621.md %})
16+
17+
This release also includes some bug fixes.
18+
See the [commit logs](https://github.com/ruby/ruby/compare/v3_0_4...v3_0_5) for further details.
19+
20+
## Download
21+
22+
{% assign release = site.data.releases | where: "version", "3.0.5" | first %}
23+
24+
* <{{ release.url.gz }}>
25+
26+
SIZE: {{ release.size.gz }}
27+
SHA1: {{ release.sha1.gz }}
28+
SHA256: {{ release.sha256.gz }}
29+
SHA512: {{ release.sha512.gz }}
30+
31+
* <{{ release.url.xz }}>
32+
33+
SIZE: {{ release.size.xz }}
34+
SHA1: {{ release.sha1.xz }}
35+
SHA256: {{ release.sha256.xz }}
36+
SHA512: {{ release.sha512.xz }}
37+
38+
* <{{ release.url.zip }}>
39+
40+
SIZE: {{ release.size.zip }}
41+
SHA1: {{ release.sha1.zip }}
42+
SHA256: {{ release.sha256.zip }}
43+
SHA512: {{ release.sha512.zip }}
44+
45+
## Release Comment
46+
47+
Many committers, developers, and users who provided bug reports helped us make this release.
48+
Thanks for their contributions.
49+
50+
The maintenance of Ruby 3.0, including this release, is based on the "Agreement for the Ruby stable version" of the Ruby Association.

‎ko/news/_posts/2022-11-24-ruby-3-1-3-released.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.1.3 Released"
4+
author: "nagachika"
5+
translator:
6+
date: 2022-11-24 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.1.3 has been released.
11+
12+
This release includes a security fix.
13+
Please check the topics below for details.
14+
15+
* [CVE-2021-33621: HTTP response splitting in CGI]({%link en/news/_posts/2022-11-22-http-response-splitting-in-cgi-cve-2021-33621.md %})
16+
17+
This release also includes a fix for build failure with Xcode 14 and macOS 13 (Ventura).
18+
See [the related ticket](https://bugs.ruby-lang.org/issues/18912) for more details.
19+
20+
See the [commit logs](https://github.com/ruby/ruby/compare/v3_1_2...v3_1_3) for further details.
21+
22+
## Download
23+
24+
{% assign release = site.data.releases | where: "version", "3.1.3" | first %}
25+
26+
* <{{ release.url.gz }}>
27+
28+
SIZE: {{ release.size.gz }}
29+
SHA1: {{ release.sha1.gz }}
30+
SHA256: {{ release.sha256.gz }}
31+
SHA512: {{ release.sha512.gz }}
32+
33+
* <{{ release.url.xz }}>
34+
35+
SIZE: {{ release.size.xz }}
36+
SHA1: {{ release.sha1.xz }}
37+
SHA256: {{ release.sha256.xz }}
38+
SHA512: {{ release.sha512.xz }}
39+
40+
* <{{ release.url.zip }}>
41+
42+
SIZE: {{ release.size.zip }}
43+
SHA1: {{ release.sha1.zip }}
44+
SHA256: {{ release.sha256.zip }}
45+
SHA512: {{ release.sha512.zip }}
46+
47+
## Release Comment
48+
49+
Many committers, developers, and users who provided bug reports helped us make this release.
50+
Thanks for their contributions.

0 commit comments

Comments
 (0)