Debian 11 Bullseye DLA-3858-1 Critical: Ruby Remote Code Execution

CVE-2021-33621

The cgi gem allows HTTP response splitting. This is relevant to
applications that use untrusted user input either to generate an
HTTP response or to create a CGI::Cookie object.

CVE-2022-28739

Buffer over-read occurs in String-to-Float conversion, including
Kernel#Float and String#to_f.

CVE-2023-28755

A ReDoS issue was discovered in the URI component. The URI parser
mishandles invalid URLs that have specific characters. It causes
an increase in execution time for parsing strings to URI objects.

CVE-2023-28756

A ReDoS issue was discovered in the Time component. The Time
parser mishandles invalid URLs that have specific characters. It
causes an increase in execution time for parsing strings to Time
objects.

CVE-2023-36617

Follow-up fix for CVE-2023-28755.

CVE-2024-27280

A buffer-overread issue was discovered in StringIO. The ungetbyte
and ungetc methods on a StringIO can read past the end of a