CVE-2017-0898 Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting i...
CriticalCVSS 9.1
EPSS 9.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 2.2.0 | No fix listed |
| ruby-lang ruby | = 2.2.1 | No fix listed |
| ruby-lang ruby | = 2.2.2 | No fix listed |
| ruby-lang ruby | = 2.2.3 | No fix listed |
| ruby-lang ruby | = 2.2.4 | No fix listed |
| ruby-lang ruby | = 2.2.5 | No fix listed |
| ruby-lang ruby | = 2.2.6 | No fix listed |
| ruby-lang ruby | = 2.2.7 | No fix listed |
| ruby-lang ruby | = 2.3.0 | No fix listed |
| ruby-lang ruby | = 2.3.1 | No fix listed |
| ruby-lang ruby | = 2.3.2 | No fix listed |
| ruby-lang ruby | = 2.3.3 | No fix listed |
| ruby-lang ruby | = 2.3.4 | No fix listed |
| ruby-lang ruby | = 2.4.0 | No fix listed |
| ruby-lang ruby | = 2.4.1 | No fix listed |
| alpine/ruby(Alpine:v3.10) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.11) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.12) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.13) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.14) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.15) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.16) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.17) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.18) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.19) | < 2.4.2-r0 | 2.4.2-r0 |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/ruby(Alpine:v3.20) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.21) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.22) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.23) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.24) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.3) | < 2.2.8-r0 | 2.2.8-r0 |
| alpine/ruby(Alpine:v3.4) | < 2.3.5-r0 | 2.3.5-r0 |
| alpine/ruby(Alpine:v3.5) | < 2.3.5-r0 | 2.3.5-r0 |
| alpine/ruby(Alpine:v3.6) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.7) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.8) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby(Alpine:v3.9) | < 2.4.2-r0 | 2.4.2-r0 |
| alpine/ruby2.2(Alpine:v3.5) | < 2.2.8-r0 | 2.2.8-r0 |
| alpine/ruby2.2(Alpine:v3.6) | < 2.2.8-r0 | 2.2.8-r0 |
| HackerOne Ruby | = Versions before 2.4.2, 2.3.5, and 2.2.8 | No fix listed |
References
- 100862 third-party-advisory vdb-entry
- 1039363 third-party-advisory vdb-entry
- RHSA-2017:3485 vendor-advisory
- RHSA-2018:0378 vendor-advisory
- RHSA-2018:0583 vendor-advisory
- RHSA-2018:0585 vendor-advisory
- github.com exploit third-party-advisory
- hackerone.com exploit third-party-advisory
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update mailing-list
- GLSA-201710-18 vendor-advisory
- USN-3685-1 vendor-advisory
- DSA-4031 vendor-advisory
- www.ruby-lang.org vendor-advisory
- security.alpinelinux.org vendor-advisory