|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2024-27280: ruby2.1,ruby2.5,ruby3.2: buffer overread vulnerability in StringIO | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | SMASH SMASH <smash_bz> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Minor | ||
| Priority: | P3 - Medium | CC: | abergmann |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/398563/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2024-27280:3.1:(AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
SMASH SMASH
2024-03-22 08:24:12 UTC
Here is the correct bug description of rh#2270750: An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. None of SUSE or openSUSE code streams are affected. Factory is already on version 3.3.0. Closing as fixed. CVE-2024-27280: Buffer overread vulnerability in StringIO
Posted by hsbt on 21 Mar 2024
We have released the StringIO gem version 3.0.1.1 and 3.0.1.2 that have a security fix for a buffer overread vulnerability. This vulnerability has been assigned the CVE identifier CVE-2024-27280.
Details
An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.
The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.
This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.
Recommended action
We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
For Ruby 3.0 users: Update to stringio 3.0.1.1
For Ruby 3.1 users: Update to stringio 3.0.1.2
Note: that StringIO 3.0.1.2 contains not only the fix for this vulnerability but also a bugfix for [Bug #19389].
You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.
Affected versions
Ruby 3.0.6 or lower
Ruby 3.1.4 or lower
StringIO gem 3.0.1 or lower
Credits
Thanks to david_h1 for discovering this issue.
History
Fixed the affected version of StringIO (3.0.2 -> 3.0.1) at 2024-04-11 12:50:00 (UTC)
Originally published at 2024-03-21 4:00:00 (UTC)
References:
https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-0-7-released/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-1-5-released/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-2-4-released/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-3-1-released/
This is an autogenerated message for OBS integration: This bug (1221851) was mentioned in https://build.opensuse.org/request/show/1169904 Factory / ruby3.3 All done, closing. |