Описание
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
A double-free vulnerability was found in Ruby. The issue occurs during Regexp compilation. This flaw allows an attacker to create a Regexp object with a crafted source string that could cause the same memory to be freed twice.
Отчет
Ruby 2.6 series and 2.7 series are not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ruby | Not affected | ||
| Red Hat Enterprise Linux 7 | ruby | Not affected | ||
| Red Hat Enterprise Linux 8 | ruby:2.5/ruby | Not affected | ||
| Red Hat Enterprise Linux 8 | ruby:2.6/ruby | Not affected | ||
| Red Hat Enterprise Linux 8 | ruby:2.7/ruby | Not affected | ||
| Red Hat Software Collections | rh-ruby27-ruby | Not affected | ||
| Red Hat Enterprise Linux 8 | ruby | Fixed | RHSA-2022:6450 | 13.09.2022 |
| Red Hat Enterprise Linux 9 | ruby | Fixed | RHSA-2022:6585 | 20.09.2022 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-ruby30-ruby | Fixed | RHSA-2022:6855 | 11.10.2022 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.7 High
CVSS3
Связанные уязвимости
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
A double free was found in the Regexp compiler in Ruby 3.x before 3.0. ...
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
Уязвимость реализации класса Regexp интерпретатора языка программирования Ruby, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.7 High
CVSS3