May 26, 2018

Fix an exploitable bug in CGI multipart parsing

Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.

* Affected application servers standalone CGI, Mongrel, WEBrick
* Unaffected FastCGI, Ruby 1.8.6 all servers
* Unknown mod_ruby

This fix will not modify versions of Ruby greater than 1.8.5, and is cumulative with previous CGI multipart vulnerability fixes.

WWW http//