Summary
It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If
a user or automated system were tricked into parsing a specially crafted
.rdoc_options file, a remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2024-27281)
It was discovered that the Ruby regex compiler incorrectly handled certain
memory operations. A remote attacker could possibly use this issue to
obtain sensitive memory contents. (CVE-2024-27282)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | ruby2.7 | 2.7.0-5ubuntu1.13 |
| Ubuntu · 22.04 LTS 22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.1 |
Vulnerabilities 2
-
Medium 6.6
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it…
-
Medium 4.5
RDoc RCE vulnerability with .rdoc_options
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no r…