First published: Wed Nov 24 2021(Updated: )
A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
rubygems/cgi | <0.1.0.1 | 0.1.0.1 |
rubygems/cgi | =0.2.0 | 0.2.1 |
rubygems/cgi | =0.3.0 | 0.3.1 |
redhat/rh-ruby26-ruby | <0:2.6.9-120.el7 | 0:2.6.9-120.el7 |
redhat/rh-ruby30-ruby | <0:3.0.4-149.el7 | 0:3.0.4-149.el7 |
redhat/rh-ruby27-ruby | <0:2.7.6-131.el7 | 0:2.7.6-131.el7 |
Ruby-lang Cgi | =0.1.0 | |
Ruby-lang Cgi | =0.2.0 | |
Ruby-lang Cgi | =0.3.0 | |
Ruby-lang Ruby | <=2.6.8 | |
Ruby-lang Ruby | >=2.7.0<2.7.5 | |
Ruby-lang Ruby | >=3.0.0<3.0.3 | |
Redhat Software Collections | ||
Redhat Enterprise Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
Debian Debian Linux | =11.0 | |
SUSE Linux Enterprise | =11.0-sp1 | |
SUSE Linux Enterprise | =12.0 | |
SUSE Linux Enterprise | =15.0 | |
openSUSE Factory | ||
openSUSE Leap | =15.2 | |
Fedoraproject Fedora | =34 | |
Fedoraproject Fedora | =35 | |
redhat/cgi | <0.3.1 | 0.3.1 |
redhat/cgi | <0.2.1 | 0.2.1 |
redhat/cgi | <0.1.1 | 0.1.1 |
redhat/ruby | <3.0.3 | 3.0.3 |
redhat/ruby | <2.7.5 | 2.7.5 |
redhat/ruby | <2.6.9 | 2.6.9 |
=0.1.0 | ||
=0.2.0 | ||
=0.3.0 | ||
<=2.6.8 | ||
>=2.7.0<2.7.5 | ||
>=3.0.0<3.0.3 | ||
=8.0 | ||
=9.0 | ||
=10.0 | ||
=11.0 | ||
=11.0-sp1 | ||
=12.0 | ||
=15.0 | ||
=15.2 | ||
=34 | ||
=35 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2021-41819 is a vulnerability in Ruby that allows remote attackers to conduct cookie prefix spoofing attacks.
CVE-2021-41819 affects the CGI gem in RubyGems, specifically the CGI::Cookie.parse function.
CVE-2021-41819 has a severity rating of high.
An attacker can exploit CVE-2021-41819 by sending a specially-crafted request to perform cookie prefix spoofing attacks.
To fix CVE-2021-41819, update to the latest version of RubyGems CGI gem that includes the necessary security patches.