CVE-2017-0898
Published: 15 September 2017
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Notes
Author | Note |
---|---|
mdeslaur | backported patch in debian (2.3.3-1+deb9u2) package |
Priority
Status
Package | Release | Status |
---|---|---|
ruby2.3 Launchpad, Ubuntu, Debian |
zesty |
Ignored
(end of life)
|
artful |
Released
(2.3.3-1ubuntu1.6)
|
|
bionic |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.3.5)
|
|
xenial |
Released
(2.3.1-2~16.04.10)
|
|
Patches: other: https://github.com/mruby/mruby/commit/f0abd4241f2a8087db4c460cf4b1f531c17c1404 |
||
ruby1.9.1 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
trusty |
Released
(1.9.3.484-2ubuntu1.5)
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
zesty |
Does not exist
|
|
ruby2.0 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
trusty |
Released
(2.0.0.484-1ubuntu2.10)
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
zesty |
Does not exist
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 9.1 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898
- https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
- http://www.securitytracker.com/id/1039363
- https://hackerone.com/reports/212241
- https://ubuntu.com/security/notices/USN-3439-1
- https://ubuntu.com/security/notices/USN-3685-1
- NVD
- Launchpad
- Debian