Most recent entries from all

ALSA-2022:0543 — Important: ruby:2.6 security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-bundler and 21 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

* rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

* ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

* ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

* ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

* ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-05837

Withdrawn: BELL-CVE-2021-41819 — CVE-2021-41819 does not affect BellSoft software

Withdrawn by the publisher.

BIT-ruby-2021-41819

Affected: Bitnami: ruby

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

CLEANSTART-2026-RI06659 — Security fix for CVE-2021-41819 applied in: ruby 3.0.3-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2022-06510

EUVD-2026-240885

fkie_cve-2021-41819

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

GHSA-4vf4-qmvg-mh7h — Cookie Prefix Spoofing in CGI::Cookie.parse

Affected: RubyGems: cgi

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.

gsd-2021-41819

msrc_CVE-2021-41819 — CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem thr…

msrc_CVE-2021-41819

OESA-2022-1497 — ruby security update

Affected: openEuler:20.03-LTS-SP1: ruby, openEuler:20.03-LTS-SP2: ruby, openEuler:20.03-LTS-SP3: ruby

Object-oriented scripting language interpreter. Security Fix(es): CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.(CVE-2021-41819)

openSUSE-SU-2024:11657-1 — libruby2_7-2_7-2.7.5-1.1 on GA media

libruby2_7-2_7-2.7.5-1.1 on GA media

RHSA-2022:0544 — Red Hat Security Advisory: ruby:2.6 security update

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source rubygem-rdoc: Command injection vulnerability in RDoc ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host ruby: StartTLS stripping vulnerability in Net::IMAP ruby: Regular expression denial of service vulnerability of Date parsing methods ruby: Cookie prefix spoofing in CGI::Cookie.parse

UBUNTU-CVE-2021-41819

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby3.0

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.