Vulnerability Database

300,214

Total vulnerabilities in the database

CVE-2021-41819

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

Software From Fixed in
ruby-lang / ruby 3.0.0 3.0.3
ruby-lang / ruby 2.7.0 2.7.5
ruby-lang / cgi 0.3.0 0.3.0.x
ruby-lang / cgi 0.2.0 0.2.0.x
ruby-lang / cgi 0.1.0 0.1.0.x
ruby-lang / ruby - 2.6.8.x
redhat / enterprise_linux 8.0 8.0.x
debian / debian_linux 9.0 9.0.x
debian / debian_linux 10.0 10.0.x
debian / debian_linux 11.0 11.0.x
suse / linux_enterprise 12.0 12.0.x
suse / linux_enterprise 15.0 15.0.x
suse / linux_enterprise 11.0-sp1 11.0-sp1.x
opensuse / leap 15.2 15.2.x
fedoraproject / fedora 34 34.x
fedoraproject / fedora 35 35.x
Ruby icon cgi 0.3.0 0.3.0.x
Ruby icon cgi 0.3.0 0.3.1
Ruby icon cgi 0.2.0 0.2.0.x
Ruby icon cgi 0.2.0 0.2.1
Ruby icon cgi - 0.1.0.1