Products
Ruby
- 3.0.0 - 3.3.0
Source
cve@mitre.org
Tags
CVE-2024-27282 details
Published : May 14, 2024, 3:11 p.m.
Last Modified : May 14, 2024, 4:13 p.m.
Last Modified : May 14, 2024, 4:13 p.m.
Description
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
References
| URL | Source |
|---|---|
| https://hackerone.com/reports/2122624 | cve@mitre.org |
| https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/ | cve@mitre.org |
This website uses the NVD API, but is not approved or certified by it.