rubygem-cgi -- HTTP response splitting vulnerability

Hiroshi Tokumaru reports:

    If an application that generates HTTP responses using the
    cgi gem with untrusted user input, an attacker can exploit
    it to inject a malicious HTTP response header and/or body.
    

    Also, the contents for a CGI::Cookie object
    were not checked properly. If an application creates a
    CGI::Cookie object based on user input, an
    attacker may exploit it to inject invalid attributes in
    Set-Cookie header. We think such applications
    are unlikely, but we have included a change to check
    arguments for CGI::Cookie#initialize
    preventatively.