CVEvulnerability
CVE-2024-27282
6.6 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2024-05-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.6 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
- Weaknesses
- CWE-125
Description
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://hackerone.com/reports/2122624 hackerone.com
- https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/ www.ruby-lang.org
- https://hackerone.com/reports/2122624 hackerone.com
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20241011-0007/ security.netapp.com
- https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/ www.ruby-lang.org