Bug 1221852 (CVE-2024-27281) - VUL-0: CVE-2024-27281: ruby3.2: RCE vulnerability with .rdoc_options in RDoc
Summary: VUL-0: CVE-2024-27281: ruby3.2: RCE vulnerability with .rdoc_options in RDoc
Status: NEW
Alias: CVE-2024-27281
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Marcus Rückert
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/398580/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-27281:4.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-22 08:24 UTC by SMASH SMASH
Modified: 2024-04-23 17:05 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-03-22 08:24:19 UTC
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27281
https://bugzilla.redhat.com/show_bug.cgi?id=2270749
https://bugzilla.redhat.com/show_bug.cgi?id=2270750
Comment 1 Alexander Bergmann 2024-03-22 08:30:42 UTC
Affected versions:

openSUSE:Factory              ruby3.3  v3.3.0
SUSE:ALP:Source:Standard:1.0  ruby3.2  v3.2.2
Comment 2 Alexander Bergmann 2024-04-23 15:11:54 UTC
CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc

Posted by hsbt on 21 Mar 2024

We have released the RDoc gem version 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 that have a security fix for a RCE vulnerability. This vulnerability has been assigned the CVE identifier CVE-2024-27281.
Details

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.
Recommended action

We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

    For Ruby 3.0 users: Update to rdoc 6.3.4.1
    For Ruby 3.1 users: Update to rdoc 6.4.1.1
    For Ruby 3.2 users: Update to rdoc 6.5.1.1

You can use gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile.

Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.
Affected versions

    Ruby 3.0.6 or lower
    Ruby 3.1.4 or lower
    Ruby 3.2.3 or lower
    Ruby 3.3.0
    RDoc gem 6.3.3 or lower, 6.4.0 through 6.6.2 without the patch versions (6.3.4, 6.4.1, 6.5.1)

Credits

Thanks to ooooooo_q for discovering this issue.
History

    Originally published at 2024-03-21 4:00:00 (UTC)

References:
https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-0-7-released/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-1-5-released/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-2-4-released/
https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-3-1-released/
Comment 3 OBSbugzilla Bot 2024-04-23 17:05:04 UTC
This is an autogenerated message for OBS integration:
This bug (1221852) was mentioned in
https://build.opensuse.org/request/show/1169904 Factory / ruby3.3