REDHAT-BUG-2349699: Medium severity Ruby CGI vulnerability

Q: What is the severity of REDHAT-BUG-2349699?

The severity of REDHAT-BUG-2349699 is classified as a Denial of Service (DoS) vulnerability.

Q: How do I fix REDHAT-BUG-2349699?

To fix REDHAT-BUG-2349699, upgrade the CGI gem to version 0.4.2 or later.

Q: Which versions of the Ruby CGI gem are affected by REDHAT-BUG-2349699?

The affected versions of the Ruby CGI gem are prior to 0.4.2.

Q: What type of vulnerability is REDHAT-BUG-2349699?

REDHAT-BUG-2349699 is a potential Denial of Service (DoS) vulnerability.

Q: What impact does REDHAT-BUG-2349699 have on applications?

REDHAT-BUG-2349699 can lead to excessive resource consumption, potentially crashing applications that use the CGI::Cookie.parse method.

Published Mar 4, 2025

Updated

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.

Affected Software

1 affected component

Ruby CGI<0.4.2

Event History

Mar 4, 2025

Data Sourced

via Red Hat·12:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2349699?

The severity of REDHAT-BUG-2349699 is classified as a Denial of Service (DoS) vulnerability.

How do I fix REDHAT-BUG-2349699?

To fix REDHAT-BUG-2349699, upgrade the CGI gem to version 0.4.2 or later.

Which versions of the Ruby CGI gem are affected by REDHAT-BUG-2349699?