CVE-2021-41819

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41819
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-41819.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-41819
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (7)
RHSA (13)
RLSA (4)
SUSE (1)
UBUNTU (1)
Related
ALSA (4)
openSUSE (7)
SUSE (1)
Published
2022-01-01T06:15:07Z
Modified
2026-04-16T00:00:59Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type
GIT
Repo
https://github.com/ruby/ruby
Events
Introduced
647ee6f091eafcce70ffb75ddf7e121e192ab217
Fixed
f69aeb83146be640995753667fdd6c6f157527f5
Introduced
95aff214687a5e12c3eb57d056665741e734c188
Fixed
3fb7d2cadc18472ec107b14234933b017a33c14d

Affected versions

Other
v2_7_0
v2_7_1
v2_7_2
v2_7_3
v2_7_4
v3_0_0
v3_0_1
v3_0_2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-41819.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "221608888545214764521643589590002473795",
                "62837079863855754692353823286478885059",
                "151633818343694841750591657495653307518",
                "112628295566100827065348454738811594068"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-41819-11445fd0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ruby/ruby/commit/3fb7d2cadc18472ec107b14234933b017a33c14d",
        "target": {
            "file": "ext/cgi/escape/escape.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "185553476159107413192269642060714357735",
            "length": 658
        },
        "id": "CVE-2021-41819-2f76299c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ruby/ruby/commit/f69aeb83146be640995753667fdd6c6f157527f5",
        "target": {
            "file": "ext/cgi/escape/escape.c",
            "function": "optimized_escape_html"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "221608888545214764521643589590002473795",
                "62837079863855754692353823286478885059",
                "151633818343694841750591657495653307518",
                "112628295566100827065348454738811594068"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-41819-799f160e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ruby/ruby/commit/f69aeb83146be640995753667fdd6c6f157527f5",
        "target": {
            "file": "ext/cgi/escape/escape.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "185553476159107413192269642060714357735",
            "length": 658
        },
        "id": "CVE-2021-41819-dfee3243",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ruby/ruby/commit/3fb7d2cadc18472ec107b14234933b017a33c14d",
        "target": {
            "file": "ext/cgi/escape/escape.c",
            "function": "optimized_escape_html"
        }
    }
]