~ / search / GHSA-4vf4-qmvg-mh7h

GHSA-4vf4-qmvg-mh7h

Cookie Prefix Spoofing in CGI::Cookie.parse

Source: GitHub Advisory Database (reviewed) High CVE-2021-41819

Packages

EcosystemPackageAffectedFixed in
RubyGems cgi >= 0.3.0, < 0.3.1 0.3.1
RubyGems cgi >= 0.2.0, < 0.2.1 0.2.1
RubyGems cgi < 0.1.0.1 0.1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.

References

External links from the advisory. They lead to third-party sites.