ALPINE-CVE-2024-27282
ALPINE-CVE-2024-27282
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS 6.6 · Medium · Fix available
- Published
- Updated
Stack: system
Affected products and versions
ruby Alpine:v3.16
- Affected ranges
- ECOSYSTEM: < 3.1.5-r0
Update to 3.1.5-r0
ruby Alpine:v3.17
- Affected ranges
- ECOSYSTEM: < 3.1.5-r0
Update to 3.1.5-r0
ruby Alpine:v3.18
- Affected ranges
- ECOSYSTEM: < 3.2.4-r0
Update to 3.2.4-r0
ruby Alpine:v3.19
- Affected ranges
- ECOSYSTEM: < 3.2.4-r0
Update to 3.2.4-r0
ruby Alpine:v3.20
- Affected ranges
- ECOSYSTEM: < 3.3.1-r0
Update to 3.3.1-r0
ruby Alpine:v3.21
- Affected ranges
- ECOSYSTEM: < 3.3.1-r0
Update to 3.3.1-r0
ruby Alpine:v3.22
- Affected ranges
- ECOSYSTEM: < 3.3.1-r0
Update to 3.3.1-r0
ruby Alpine:v3.23
- Affected ranges
- ECOSYSTEM: < 3.3.1-r0
Update to 3.3.1-r0
ruby Alpine:v3.24
- Affected ranges
- ECOSYSTEM: < 3.3.1-r0
Update to 3.3.1-r0