CVE-2021-41819

Published: Jan 1, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

Affected (18)

Products: Ruby Lang: Cgi, Ruby · Redhat: Enterprise Linux, Software Collections · Debian: Debian Linux · +3 more

Show all products

Ruby Lang: Cgi, Ruby · Redhat: Enterprise Linux, Software Collections · Debian: Debian Linux · Suse: Linux Enterprise · Opensuse: Factory, Leap · Fedoraproject: Fedora

2 products

2 products

Enterprise Linux

Software Collections

1 product

1 product

Linux Enterprise

2 products

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Cgi	Version 0.1.0
Ruby Lang Cgi	Version 0.2.0
Ruby Lang Cgi	Version 0.3.0
Ruby Lang Ruby	Up to 2.6.8
Ruby Lang Ruby	From 2.7.0 to 2.7.5
Ruby Lang Ruby	From 3.0.0 to 3.0.3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Software Collections	All versions

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise	Version 11.0 sp1
Suse Linux Enterprise	Version 12.0
Suse Linux Enterprise	Version 15.0

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Factory	All versions
Opensuse Leap	Version 15.2

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Related CWEs

Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

References (12)

https://hackerone.com/reports/910552

Source: cve@mitre.org

Permissions RequiredThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202401-27

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20220121-0003/

Source: cve@mitre.org

Third Party Advisory

https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/

Source: cve@mitre.org

ExploitVendor Advisory

https://hackerone.com/reports/910552

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions RequiredThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202401-27

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20220121-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.