CVE-2024-27282

CVSS 6.6 MEDIUMEPSS 0.6%CWE-125

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.6EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 May 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Affected products

n/a · n/a

References

https://hackerone.com/reports/2122624 https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N/https://security.netapp.com/advisory/ntap-20241011-0007/https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/