Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.6
CVE-2024-27282: Ruby 3.x may expose memory data via crafted patterns
CVE-2024-27282 · published 2 years ago
Summary
Ruby versions 3.0 through 3.3.0 can unintentionally reveal memory contents when a specially crafted regular expression is processed. This could allow an attacker to read sensitive information stored in the program's memory. Update Ruby to version 3.0.7, 3.1.5, 3.2.4, or 3.3.1 or later to fix the issue.
What to do
- Update debian ruby3.1 to version 3.1.2-7+deb12u1.
- Update canonical ruby2.5 to version 2.5.1-1ubuntu1.16+esm5.
- Update canonical ruby2.7 to version 2.7.0-5ubuntu1.13.
- Update canonical ruby3.0 to version 3.0.2-7ubuntu2.6.
- Update canonical ruby3.2 to version 3.2.3-1ubuntu0.24.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | ruby3.1 |
< 3.1.2-7+deb12u1 Fix: upgrade to 3.1.2-7+deb12u1
|
| Ubuntu:Pro:14.04:LTS | canonical | jruby | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | ruby2.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | ruby2.5 |
< 2.5.1-1ubuntu1.16+esm5 Fix: upgrade to 2.5.1-1ubuntu1.16+esm5
|
| Ubuntu:20.04:LTS | canonical | ruby2.7 |
< 2.7.0-5ubuntu1.13 Fix: upgrade to 2.7.0-5ubuntu1.13
|
| Ubuntu:22.04:LTS | canonical | ruby3.0 |
< 3.0.2-7ubuntu2.6 Fix: upgrade to 3.0.2-7ubuntu2.6
|
| Ubuntu:24.04:LTS | canonical | ruby3.2 |
< 3.2.3-1ubuntu0.24.04.1 Fix: upgrade to 3.2.3-1ubuntu0.24.04.1
|
Original advisory text
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text,...
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
References
- https://security-tracker.debian.org/tracker/CVE-2024-27282 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-27282 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-27282 Third Party Advisory
- https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a Third Party Advisory
- https://ubuntu.com/security/notices/USN-6838-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7734-1 Vendor Advisory
- https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regex... Third Party Advisory
- https://hackerone.com/reports/2122624
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://security.netapp.com/advisory/ntap-20241011-0007/
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published14 May 2024
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta