CVE-2024-27280
EUVD-2024-100814.05.2024, 15:11
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| ruby-lang | ruby | 3.0.3 ≤ 𝑥 ≤ 3.0.6 | ADP |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ruby2.3 |
| ||||||||||||||||||||
| ruby2.5 |
| ||||||||||||||||||||
| ruby2.7 |
| ||||||||||||||||||||
| ruby3.0 |
| ||||||||||||||||||||
| ruby3.1 |
| ||||||||||||||||||||
| ruby3.2 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| ruby |
| ||
| ruby-default-gems |
| ||
| ruby-devel |
| ||
| ruby-doc |
| ||
| ruby-libs |
| ||
| rubygem-bigdecimal |
| ||
| rubygem-bundler |
| ||
| rubygem-io-console |
| ||
| rubygem-irb |
| ||
| rubygem-json |
| ||
| rubygem-minitest |
| ||
| rubygem-power |
| ||
| rubygem-psych |
| ||
| rubygem-rake |
| ||
| rubygem-rbs |
| ||
| rubygem-rdoc |
| ||
| rubygem-rexml |
| ||
| rubygem-rss |
| ||
| rubygem-test-unit |
| ||
| rubygem-typeprof |
| ||
| rubygems |
| ||
| rubygems-devel |
|
References