CVE-2024-27282
May 14, 2024, 4:13 p.m.
Tags
Product(s) Impacted
Ruby
- 3.0.0 - 3.3.0
Description
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
Weaknesses
Date
Published: May 14, 2024, 3:11 p.m.
Last Modified: May 14, 2024, 4:13 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cve@mitre.org