| Package | Affected versions | Patched versions |
|---|---|---|
| cgi | ≥ 0.2.0, < 0.2.1≥ 0.3.0, < 0.3.1< 0.1.0.1 | 0.2.10.3.10.1.0.1 |
| cgi | = 0.1.0= 0.2.0= 0.3.0 | |
| ruby | ≥ 2.7.0, < 2.7.5≥ 3.0.0, < 3.0.3≤ 2.6.8 | 2.7.53.0.3 |
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free