CVE-2021-41819
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Description d'origine
La description telle que publiée par la source (souvent en anglais).
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
ruby-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.9"},{"introduced":"2.7.0"},{"fixed":"2.7.5"},{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]
Bitnami
ruby
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.9"},{"introduced":"2.7.0"},{"fixed":"2.7.5"},{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2021-41819 ruby Corrigé dans: 2.7.5-r0
- Debian DEBIAN-CVE-2021-41819 ruby2.7 Corrigé dans: 2.7.4-1+deb11u1
Références
- advisory hackerone.com
- advisory security.netapp.com
- advisory ruby-lang.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web security.gentoo.org
- web nvd.nist.gov