NA

CVE-2024-27282

Vulnerability Summary

Ruby Arbitrary memory address read vulnerability with Regex search. An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings.

Vulnerability Trend

Vendor Advisories

Debian Bug report logs - #1069968 ruby32: CVE-2024-27282 Package: src:ruby32; Maintainer for src:ruby32 is Debian Ruby Team <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 27 Apr 2024 20:27:02 UTC Severity: grave Tags: security, upstream Foun ...