GHSA-vc47-6rqg-c7f5 HTTP response splitting in CGI

• RubyGems cgi: >= 0.3.0, < 0.3.5 → fixed in 0.3.5 • RubyGems cgi: >= 0.2.0, < 0.2.2 → fixed in 0.2.2 • RubyGems cgi: < 0.1.0.2 → fixed in 0.1.0.2

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.