CVE-2024-27281

EUVD-2024-0826

14.05.2024, 15:11

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.5 MEDIUM	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 72%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
ruby	rdoc	6.3.3 ≤ 𝑥 ≤ 6.6.2	ADP

Debian Releases

Debian Product

Codename

ruby2.7

bullseye	vulnerable
bullseye (security)	2.7.4-1+deb11u5 fixed

ruby3.1

bookworm	3.1.2-7+deb12u1 fixed
bookworm (security)	3.1.2-7+deb12u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ruby2.3

focal	dne
jammy	dne
mantic	dne
noble	dne
oracular	dne
plucky	dne
questing	dne
xenial	Fixed 2.3.1-2~ubuntu16.04.16+esm9 released

ruby2.5

bionic	Fixed 2.5.1-1ubuntu1.16+esm3 released
focal	dne
jammy	dne
mantic	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

ruby2.7

focal	Fixed 2.7.0-5ubuntu1.13 released
jammy	dne
mantic	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

ruby3.0

focal	dne
jammy	Fixed 3.0.2-7ubuntu2.6 released
mantic	dne
noble	dne
oracular	dne
plucky	dne
questing	dne

ruby3.1

focal	dne
jammy	dne
mantic	Fixed 3.1.2-7ubuntu3.2 released
noble	dne
oracular	dne
plucky	dne
questing	dne

jruby

bionic	needs-triage
focal	needs-triage
jammy	dne
mantic	ignored
noble	needs-triage
oracular	ignored
plucky	needs-triage
questing	needs-triage
trusty	needs-triage
xenial	needs-triage

ruby3.2

bionic	dne
focal	dne
jammy	dne
mantic	dne
noble	Fixed 3.2.3-1ubuntu0.24.04.1 released
oracular	dne
plucky	dne
questing	dne
trusty	dne
xenial	dne

ruby3.3

bionic	dne
focal	dne
jammy	dne
mantic	dne
noble	dne
oracular	not-affected
plucky	not-affected
questing	not-affected
trusty	dne
xenial	dne

Red Hat Enterprise Linux Releases

Red Hat Product

Release

ruby

RHEL 9

0:3.0.7-162.el9_4

fixed

ruby-default-gems

RHEL 9

0:3.0.7-162.el9_4

fixed

ruby-devel

RHEL 9

0:3.0.7-162.el9_4

fixed

ruby-doc

RHEL 9

0:3.0.7-162.el9_4

fixed

ruby-libs

RHEL 9

0:3.0.7-162.el9_4

fixed

rubygem-bigdecimal

RHEL 9

0:3.0.0-162.el9_4

fixed

rubygem-bundler

RHEL 9

0:2.2.33-162.el9_4

fixed

rubygem-io-console

RHEL 9

0:0.5.7-162.el9_4

fixed

rubygem-irb

RHEL 9

0:1.3.5-162.el9_4

fixed

rubygem-json

RHEL 9

0:2.5.1-162.el9_4

fixed

rubygem-minitest

RHEL 9

0:5.14.2-162.el9_4

fixed

rubygem-power

RHEL 9

0:1.2.1-162.el9_4

fixed

rubygem-psych

RHEL 9

0:3.3.2-162.el9_4

fixed

rubygem-rake

RHEL 9

0:13.0.3-162.el9_4

fixed

rubygem-rbs

RHEL 9

0:1.4.0-162.el9_4

fixed

rubygem-rdoc

RHEL 9

0:6.3.4.1-162.el9_4

fixed

rubygem-rexml

RHEL 9

0:3.2.5-162.el9_4

fixed

rubygem-rss

RHEL 9

0:0.2.9-162.el9_4

fixed

rubygem-test-unit

RHEL 9

0:3.3.7-162.el9_4

fixed

rubygem-typeprof

RHEL 9

0:0.15.2-162.el9_4

fixed

rubygems

RHEL 9

0:3.2.33-162.el9_4

fixed

rubygems-devel

RHEL 9

0:3.2.33-162.el9_4

fixed

Amazon Linux Releases

Amazon Package

Release

ruby

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby-debuginfo

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby-devel

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby-doc

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby-irb

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby-libs

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby-tcltk

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.11

fixed

ruby3.2

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-bundled-gems

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-bundled-gems-debuginfo

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-debuginfo

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-debugsource

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-default-gems

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-devel

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-doc

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-libs

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-libs-debuginfo

Amazon Linux 2023

0:3.2.2-180.amzn2023.0.3

fixed

ruby3.2-rubygem-bigdecimal

Amazon Linux 2023

0:3.1.3-180.amzn2023.0.3

fixed

ruby3.2-rubygem-bigdecimal-debuginfo

Amazon Linux 2023

0:3.1.3-180.amzn2023.0.3

fixed

ruby3.2-rubygem-bundler

Amazon Linux 2023

0:2.4.10-180.amzn2023.0.3

fixed

ruby3.2-rubygem-io-console

Amazon Linux 2023

0:0.6.0-180.amzn2023.0.3

fixed

ruby3.2-rubygem-io-console-debuginfo

Amazon Linux 2023

0:0.6.0-180.amzn2023.0.3

fixed

ruby3.2-rubygem-irb

Amazon Linux 2023

0:1.6.2-180.amzn2023.0.3

fixed

ruby3.2-rubygem-json

Amazon Linux 2023

0:2.6.3-180.amzn2023.0.3

fixed

ruby3.2-rubygem-json-debuginfo

Amazon Linux 2023

0:2.6.3-180.amzn2023.0.3

fixed

ruby3.2-rubygem-minitest

Amazon Linux 2023

0:5.16.3-180.amzn2023.0.3

fixed

ruby3.2-rubygem-power_assert

Amazon Linux 2023

0:2.0.3-180.amzn2023.0.3

fixed

ruby3.2-rubygem-psych

Amazon Linux 2023

0:5.0.1-180.amzn2023.0.3

fixed

ruby3.2-rubygem-psych-debuginfo

Amazon Linux 2023

0:5.0.1-180.amzn2023.0.3

fixed

ruby3.2-rubygem-rake

Amazon Linux 2023

0:13.0.6-180.amzn2023.0.3

fixed

ruby3.2-rubygem-rbs

Amazon Linux 2023

0:2.8.2-180.amzn2023.0.3

fixed

ruby3.2-rubygem-rbs-debuginfo

Amazon Linux 2023

0:2.8.2-180.amzn2023.0.3

fixed

ruby3.2-rubygem-rdoc

Amazon Linux 2023

0:6.5.0-180.amzn2023.0.3

fixed

ruby3.2-rubygem-rexml

Amazon Linux 2023

0:3.2.5-180.amzn2023.0.3

fixed

ruby3.2-rubygem-rss

Amazon Linux 2023

0:0.2.9-180.amzn2023.0.3

fixed

ruby3.2-rubygem-test-unit

Amazon Linux 2023

0:3.5.7-180.amzn2023.0.3

fixed

ruby3.2-rubygem-typeprof

Amazon Linux 2023

0:0.21.3-180.amzn2023.0.3

fixed

ruby3.2-rubygems

Amazon Linux 2023

0:3.4.10-180.amzn2023.0.3

fixed

ruby3.2-rubygems-devel

Amazon Linux 2023

0:3.4.10-180.amzn2023.0.3

fixed

rubygem-bigdecimal

Amazon Linux 2

0:1.2.0-36.amzn2.0.11

fixed

rubygem-io-console

Amazon Linux 2

0:0.4.2-36.amzn2.0.11

fixed

rubygem-json

Amazon Linux 2

0:1.7.7-36.amzn2.0.11

fixed

rubygem-minitest

Amazon Linux 2

0:4.3.2-36.amzn2.0.11

fixed

rubygem-psych

Amazon Linux 2

0:2.0.0-36.amzn2.0.11

fixed

rubygem-rake

Amazon Linux 2

0:0.9.6-36.amzn2.0.11

fixed

rubygem-rdoc

Amazon Linux 2

0:4.0.0-36.amzn2.0.11

fixed

rubygems

Amazon Linux 2

0:2.0.14.1-36.amzn2.0.11

fixed

rubygems-devel

Amazon Linux 2

0:2.0.14.1-36.amzn2.0.11

fixed

Azure Linux Releases

Azure Package

Release

ruby

Azure Linux 3.0	0:3.3.3-1.azl3 fixed
CBL-Mariner 2.0	0:3.1.4-4.cm2 fixed

Common Weakness Enumeration

CWE-502 - Deserialization of Untrusted Data
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References

https://hackerone.com/reports/1187477

https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/

https://hackerone.com/reports/1187477

https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N/

https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/