high7.5
CVE-2021-41819
Cookie Prefix Spoofing in CGI::Cookie.parse
Impact
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | cgi | = 0.3.0 | 0.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ruby-Lang | Cgi | Versions 0.1.0, 0.2.0, 0.3.0 |
| Ruby-Lang | Ruby | through 2.6.8 from 2.7.0 before 2.7.5 from 3.0.0 before 3.0.3 |
| Redhat | Software Collections | All versions |
| Redhat | Enterprise Linux | Version 8.0 |
| Debian | Debian Linux | Versions 9.0, 10.0, 11.0 |
| Suse | Linux Enterprise | Versions 11.0, 12.0, 15.0 |
| Opensuse | Factory | All versions |
| Opensuse | Leap | Version 15.2 |
| Fedoraproject | Fedora | Versions 34, 35 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://hackerone.com/reports/910552
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20220121-0003/
- https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/
- https://github.com/advisories/GHSA-4vf4-qmvg-mh7h
- https://nvd.nist.gov/vuln/detail/CVE-2021-41819
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41819.yml