CVE-2017-0898
Published: 15 September 2017
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Priority
Medium
CVSS 3 base score: 9.1
Status
| Package | Release | Status |
|---|---|---|
|
ruby1.9.1 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
(trusty was released [1.9.3.484-2ubuntu1.5])
|
|
|
ruby2.0 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
(trusty was released [2.0.0.484-1ubuntu2.10])
|
|
|
ruby2.3 Launchpad, Ubuntu, Debian |
Upstream |
Released
(2.3.5)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Released
(2.3.1-2~16.04.10)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
Patches: Other: https://github.com/mruby/mruby/commit/f0abd4241f2a8087db4c460cf4b1f531c17c1404 |
||
Notes
| Author | Note |
|---|---|
| mdeslaur | backported patch in debian (2.3.3-1+deb9u2) package |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898
- https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
- http://www.securitytracker.com/id/1039363
- https://hackerone.com/reports/212241
- https://usn.ubuntu.com/usn/usn-3439-1
- https://usn.ubuntu.com/usn/usn-3685-1
- NVD
- Launchpad
- Debian