CVE-2021-41819

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

Object-oriented scripting language interpreter.

Security Fix(es):

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.(CVE-2021-41819)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.6). (BZ#2109424)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109431)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

• Ruby: Double free in Regexp compilation (CVE-2022-28738)

• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• ruby 3.0: User-installed rubygems plugins are not being loaded [Rocky Linux8] (BZ#2110981)

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.6). (BZ#2109424)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109431)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
• Ruby: Double free in Regexp compilation (CVE-2022-28738)
• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• ruby 3.0: User-installed rubygems plugins are not being loaded [AlmaLinux8] (BZ#2110981)

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

• CVE-2021-41819: when parsing cookies, only decode the values

Bundler sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. (CVE-2020-36327)

The REXML gem does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. (CVE-2021-28965)

In RDoc it is possible to execute arbitrary code via | and tags in a filename. (CVE-2021-31799)

A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

Ruby Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." (CVE-2021-32066)

Buffer Overrun in CGI.escape_html (CVE-2021-41816)

Regular Expression Denial of Service Vulnerability of Date Parsing Methods (CVE-2021-41817)

Cookie Prefix Spoofing in CGI::Cookie.parse (CVE-2021-41819)

These are all security issues fixed in the libruby2_7-2_7-2.7.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_0-3_0-3.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_1-3_1-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_2-3_2-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_3-3_3-3.3.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_4-3_4-3.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby4_0-4_0-4.0.0~preview2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ruby2.5 fixes the following issues:

• CVE-2021-41819: Fixed cookie prefix spoofing in CGI::Cookie.parse (bsc#1193081).

It was discovered that Ruby incorrectly handled certain HTML files. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. (CVE-2021-41816)

It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a regular expression denial of service. (CVE-2021-41817)

It was discovered that Ruby incorrectly handled certain cookie names. An attacker could possibly use this issue to access or expose sensitive information. (CVE-2021-41819)