Moderate: ruby:3.1 security, bug fix, and enhancement update
Summary
ALSA-2024:3546: Moderate: ruby:3.1 security, bug fix, and enhancement update. Affects ruby versions < 3.1.5-143.module_el8.10.0+3854+02eaa59a. Fixed in 3.1.5-143.module_el8.10.0+3854+02eaa59a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This update addresses multiple vulnerabilities in Ruby 3.1:
-
RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281): This vulnerability could allow remote code execution when processing specially crafted .rdoc_options files in RDoc. An attacker could exploit this to execute arbitrary code with the privileges of the user running the application.
-
Buffer overread vulnerability in StringIO (CVE-2024-27280): This vulnerability could allow an attacker to read uninitialized memory when processing certain input in StringIO. This could potentially lead to the disclosure of sensitive information.
-
Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282): This vulnerability could allow an attacker to read arbitrary memory addresses when performing a regex search. This could potentially lead to the disclosure of sensitive information.
How To Fix
Minimum fixed version
3.1.5-143.module_el8.10.0+3854+02eaa59a
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple vulnerabilities in Ruby 3.1, including RCE, buffer overread, and arbitrary memory address read vulnerabilities. It is recommended to update the affected packages to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
Ruby is an extensible, interpreted, object-oriented, scripting language known for its simplicity and productivity.
RCE stands for Remote Code Execution. It is a vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
An attacker can exploit the RCE vulnerability in RDoc by crafting a specially crafted .rdoc_options file and tricking a user into processing it with RDoc. This can lead to the execution of arbitrary code with the privileges of the user running the application.
A buffer overread vulnerability occurs when a program reads more data from a buffer than it should, potentially leading to the disclosure of sensitive information or a crash of the program.
An attacker can exploit the buffer overread vulnerability in StringIO by providing certain input that triggers the overread. This can potentially lead to the disclosure of uninitialized memory and sensitive information.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
