Bugzilla – Bug 1221851
VUL-0: CVE-2024-27280: ruby2.1,ruby2.5,ruby3.2: buffer overread vulnerability in StringIO
Last modified: 2024-06-11 09:58:52 UTC
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27280 https://bugzilla.redhat.com/show_bug.cgi?id=2270749 https://bugzilla.redhat.com/show_bug.cgi?id=2270750
Here is the correct bug description of rh#2270750: An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.
None of SUSE or openSUSE code streams are affected. Factory is already on version 3.3.0. Closing as fixed.
CVE-2024-27280: Buffer overread vulnerability in StringIO Posted by hsbt on 21 Mar 2024 We have released the StringIO gem version 3.0.1.1 and 3.0.1.2 that have a security fix for a buffer overread vulnerability. This vulnerability has been assigned the CVE identifier CVE-2024-27280. Details An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. Recommended action We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.0.1.2 Note: that StringIO 3.0.1.2 contains not only the fix for this vulnerability but also a bugfix for [Bug #19389]. You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile. Affected versions Ruby 3.0.6 or lower Ruby 3.1.4 or lower StringIO gem 3.0.1 or lower Credits Thanks to david_h1 for discovering this issue. History Fixed the affected version of StringIO (3.0.2 -> 3.0.1) at 2024-04-11 12:50:00 (UTC) Originally published at 2024-03-21 4:00:00 (UTC) References: https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/ https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-0-7-released/ https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-1-5-released/ https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-2-4-released/ https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-3-1-released/
This is an autogenerated message for OBS integration: This bug (1221851) was mentioned in https://build.opensuse.org/request/show/1169904 Factory / ruby3.3
All done, closing.