Описание
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
A buffer overread flaw was found in rubygem StringIO. The ungetbyte and ungetc methods on a StringIO object can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ruby | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ruby | Out of support scope | ||
| Red Hat OpenStack Platform 16.2 | puppet-memcached | Not affected | ||
| Red Hat OpenStack Platform 17.1 | puppet-memcached | Not affected | ||
| Red Hat Satellite 6 | satellite-installer | Not affected | ||
| Red Hat Storage 3 | ruby | Affected | ||
| Red Hat Enterprise Linux 8 | ruby | Fixed | RHSA-2024:3500 | 30.05.2024 |
| Red Hat Enterprise Linux 8 | ruby | Fixed | RHSA-2024:3546 | 03.06.2024 |
| Red Hat Enterprise Linux 8 | ruby | Fixed | RHSA-2024:3670 | 06.06.2024 |
| Red Hat Enterprise Linux 8 | ruby | Fixed | RHSA-2024:4499 | 11.07.2024 |
Показывать по
Дополнительная информация
Статус:
3.1 Low
CVSS3
Связанные уязвимости
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
A buffer-overread issue was discovered in StringIO 3.0.1, as distribut ...
Уязвимость методов ungetbyte и ungetc обработчика строк StringIO для языка программирования Ruby, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации
3.1 Low
CVSS3