Cookie Prefix Spoofing in CGI::Cookie.parse
High severity
GitHub Reviewed
Published
Jan 21, 2022
to the GitHub Advisory Database
•
Updated Jan 24, 2024
Package
Affected versions
= 0.3.0
= 0.2.0
< 0.1.0.1
Patched versions
0.3.1
0.2.1
0.1.0.1
Description
Published by the National Vulnerability Database
Jan 1, 2022
Reviewed
Jan 13, 2022
Published to the GitHub Advisory Database
Jan 21, 2022
Last updated
Jan 24, 2024
Credits
-
kir-b Analyst
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
References