CVE:CVE-2021-41819
CNNVD:CNNVD-202111-2092
Ruby是松本行弘个人开发者的一种跨平台、面向对象的动态类型编程语言。
Ruby 2.6.8 版本及之前版本存在安全漏洞，该漏洞源于 CGI::Cookie.parse 错误处理 cookie 名称中的安全前缀。攻击者可利用该漏洞来欺骗cookie名称中的安全前缀，这样就可以欺骗易受攻击的应用程序。
solution:Upgrade ruby-lang cgi to a higher version than 0.1.0,0.2.0,0.3.0,and avoid the version 0.1.0,0.2.0,0.3.0; Upgrade ruby-lang ruby to a higher version than 2.6.8,2.7.5,3.0.3,and avoid the version (,2.6.8],[2.7.0,2.7.5),[3.0.0,3.0.3); Upgrade redhat software_collections to a higher version than -; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade debian debian_linux to a higher version than 9.0,10.0,11.0,and avoid the version 9.0,10.0,11.0; Upgrade suse linux_enterprise to a higher version than 11.0:sp1,12.0,15.0,and avoid the version 11.0:sp1,12.0,15.0; Upgrade opensuse factory to a higher version than -; Upgrade opensuse leap to a higher version than 15.2,and avoid the version 15.2; Upgrade fedoraproject fedora to a higher version than 34,35,and avoid the version 34,35