CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bundler-docUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-bson-docUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade ruby-irbUpgrade rubygem-bsonUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-bundler | May 4, 2022 | Jan 1, 2022 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Jan 1, 2022 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubyUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-psych | Sep 28, 2023 | Jan 1, 2022 |
| Centos_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-rbsUpgrade rubygem-typeprofUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade ruby-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade rubygem-rssUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-rake | Feb 17, 2022 | Jan 1, 2022 |
| Debian | — | Upgrade ruby2.7 | Dec 28, 2021 | Dec 28, 2021 |
| Freebsd | — | Upgrade ruby27Upgrade rubyUpgrade ruby30Upgrade ruby26Upgrade rubygem-cgi | Nov 4, 2022 | Nov 24, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jan 1, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Apr 20, 2022 | Jan 1, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 25, 2022 | Jan 1, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Mar 22, 2022 | Jan 1, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Mar 29, 2022 | Jan 1, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Apr 19, 2022 | Jan 1, 2022 |
| Oracle_linux | — | Upgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-rssUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade ruby-docUpgrade ruby-irbUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-did_you_meanUpgrade rubygem-rexmlUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygem-rdoc | Feb 17, 2022 | Nov 24, 2021 |
| Redhat_linux | — | Upgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-minitestUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-rexmlUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-bundler-docUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-irbNo solution existsUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-rssUpgrade ruby-libsUpgrade rubygem-rbs | Feb 17, 2022 | Jan 1, 2022 |
| Rocky_linux | — | Upgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debugsource | Mar 5, 2024 | Jan 1, 2022 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-ri | Oct 26, 2022 | Jan 1, 2022 |
| Ubuntu | — | Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby2.5 | Jan 19, 2022 | Jan 1, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub