Description
The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jruby | 1.5.0~rc1-1 | — |
| Debian 13 | jruby | 1.5.0~rc1-1 | — |
| Debian 12 | jruby | 1.5.0~rc1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jruby:jruby-core | < 1.4.1 | 1.4.1 | GHSA-wmq2-jc9m-xp4m |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=750306
- RHSA-2011:1456 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=317435
- 77297 vdb-entry
- 46891 third-party-advisory
- http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html
- jruby-expression-engine-xss(80277) vdb-entry