โ™Š๏ธ GemiNews ๐Ÿ—ž๏ธ

Demo 1: Embeddings + Recommendation Demo 2: Bella RAGa Demo 3: NewRetriever Demo 4: Assistant function calling

๐Ÿ—ž๏ธCVE-2024-27280: Buffer overread vulnerability in StringIO

๐Ÿ—ฟSemantically Similar Articles (by :title_embedding)

CVE-2024-27280: Buffer overread vulnerability in StringIO

2024-03-21 - (from Ruby (EN RSS))

We have released the StringIO gem version 3.0.1.1 and 3.0.1.2 that have a security fix for a buffer overread vulnerability. This vulnerability has been assigned the CVE identifier CVE-2024-27280. Details An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. Recommended action We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.0.1.2 Note: that StringIO 3.0.1.2 contains not only the fix for this vulnerability but also a bugfix for [Bug #19389]. You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile. Affected versions Ruby 3.0.6 or lower Ruby 3.1.4 or lower StringIO gem 3.0.2 or lower Credits Thanks to david_h1 for discovering this issue. History Originally published at 2024-03-21 4:00:00 (UTC) Posted by hsbt on 21 Mar 2024

[Technology] ๐ŸŒŽ https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/

๐Ÿ—ฟarticle.to_s 

------------------------------
Title: CVE-2024-27280: Buffer overread vulnerability in StringIO
Summary: We have released the StringIO gem version 3.0.1.1 and 3.0.1.2 that have a security fix for a buffer overread vulnerability.
This vulnerability has been assigned the CVE identifier CVE-2024-27280.

Details

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.

This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.

Recommended action

We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:


  For Ruby 3.0 users: Update to stringio 3.0.1.1
  For Ruby 3.1 users: Update to stringio 3.0.1.2


Note: that StringIO 3.0.1.2 contains not only the fix for this vulnerability but also a bugfix for [Bug #19389].

You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

Affected versions


  Ruby 3.0.6 or lower
  Ruby 3.1.4 or lower
  StringIO gem 3.0.2 or lower


Credits

Thanks to david_h1 for discovering this issue.

History


  Originally published at 2024-03-21 4:00:00 (UTC)


Posted by hsbt on 21 Mar 2024

PublishedDate: 2024-03-21
Category: Technology
NewsPaper: Ruby (EN RSS)
{"id"=>3155,
"title"=>"CVE-2024-27280: Buffer overread vulnerability in StringIO",
"summary"=>"

We have released the StringIO gem version 3.0.1.1 and 3.0.1.2 that have a security fix for a buffer overread vulnerability.\nThis vulnerability has been assigned the CVE identifier CVE-2024-27280.

\n\n

Details

\n\n

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

\n\n

The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.

\n\n

This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.

\n\n

Recommended action

\n\n

We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

\n\n
    \n
  • For Ruby 3.0 users: Update to stringio 3.0.1.1
    • \n
  • For Ruby 3.1 users: Update to stringio 3.0.1.2
    • \n
\n\n

Note: that StringIO 3.0.1.2 contains not only the fix for this vulnerability but also a bugfix for [Bug #19389].

\n\n

You can use gem update stringio to update it. If you are using bundler, please add gem \"stringio\", \">= 3.0.1.2\" to your Gemfile.

\n\n

Affected versions

\n\n
    \n
  • Ruby 3.0.6 or lower
    • \n
  • Ruby 3.1.4 or lower
    • \n
  • StringIO gem 3.0.2 or lower
    • \n
\n\n

Credits

\n\n

Thanks to david_h1 for discovering this issue.

\n\n

History

\n\n
    \n
  • Originally published at 2024-03-21 4:00:00 (UTC)
    • \n
\n\n

Posted by hsbt on 21 Mar 2024

",
"content"=>nil,
"author"=>nil,
"link"=>"https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/",
"published_date"=>Thu, 21 Mar 2024 04:00:00.000000000 UTC +00:00,
"image_url"=>nil,
"feed_url"=>"https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/",
"language"=>nil,
"active"=>true,
"ricc_source"=>"feedjira::v1",
"created_at"=>Wed, 03 Apr 2024 14:31:19.047251000 UTC +00:00,
"updated_at"=>Mon, 13 May 2024 19:03:25.195620000 UTC +00:00,
"newspaper"=>"Ruby (EN RSS)",
"macro_region"=>"Technology"}
Edit this article
Back to articles