p PatchFirst

CVE-2024-27282

CVE-2024-27282

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.

CVSS 6.6 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ruby3.1 Debian:12

    Versions
    • 3.1.2-7
    Affected ranges
    • ECOSYSTEM: < 3.1.2-7+deb12u1

    Update to 3.1.2-7+deb12u1

  • jruby Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.6-5ubuntu1
    • 1.5.6-6
    • 1.5.6-7
    • 1.5.6-9+deb8u2build0.14.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.3 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    • 2.3.1-2~16.04.12
    • 2.3.1-2~ubuntu16.04.13
    • 2.3.1-2~ubuntu16.04.14
    • 2.3.1-2~ubuntu16.04.15
    • 2.3.1-2~ubuntu16.04.16
    • 2.3.1-2~ubuntu16.04.16+esm1
    • 2.3.1-2~ubuntu16.04.16+esm2
    • 2.3.1-2~ubuntu16.04.16+esm3
    • 2.3.1-2~ubuntu16.04.16+esm4
    • 2.3.1-2~ubuntu16.04.16+esm5
    • 2.3.1-2~ubuntu16.04.16+esm6
    • 2.3.1-2~ubuntu16.04.16+esm7
    • 2.3.1-2~ubuntu16.04.16+esm8
    • 2.3.1-2~ubuntu16.04.16+esm9
    • 2.3.1-2~ubuntu16.04.16+esm10
    • 2.3.1-2~ubuntu16.04.16+esm11
    • 2.3.1-2~ubuntu16.04.16+esm12
    • 2.3.1-2~ubuntu16.04.16+esm14
    • 2.3.1-2~ubuntu16.04.16+esm15
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:16.04:LTS

    Versions
    • 1.7.21-2ubuntu4
    • 1.7.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.5 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    • 2.5.1-1ubuntu1.2
    • 2.5.1-1ubuntu1.4
    • 2.5.1-1ubuntu1.5
    • 2.5.1-1ubuntu1.6
    • 2.5.1-1ubuntu1.7
    • 2.5.1-1ubuntu1.8
    • 2.5.1-1ubuntu1.9
    • 2.5.1-1ubuntu1.10
    • 2.5.1-1ubuntu1.11
    • 2.5.1-1ubuntu1.12
    • 2.5.1-1ubuntu1.13
    • 2.5.1-1ubuntu1.14
    • 2.5.1-1ubuntu1.15
    • 2.5.1-1ubuntu1.16
    • 2.5.1-1ubuntu1.16+esm1
    • 2.5.1-1ubuntu1.16+esm3
    • 2.5.1-1ubuntu1.16+esm4
    Affected ranges
    • ECOSYSTEM: < 2.5.1-1ubuntu1.16+esm5

    Update to 2.5.1-1ubuntu1.16+esm5

  • jruby Ubuntu:18.04:LTS

    Versions
    • 9.1.13.0-1
    • 9.1.17.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.7 Ubuntu:20.04:LTS

    Versions
    • 2.7.0-1
    • 2.7.0-2
    • 2.7.0-3
    • 2.7.0-4
    • 2.7.0-4ubuntu1
    • 2.7.0-5ubuntu1
    • 2.7.0-5ubuntu1.1
    • 2.7.0-5ubuntu1.2
    • 2.7.0-5ubuntu1.3
    • 2.7.0-5ubuntu1.4
    • 2.7.0-5ubuntu1.5
    • 2.7.0-5ubuntu1.6
    • 2.7.0-5ubuntu1.7
    • 2.7.0-5ubuntu1.8
    • 2.7.0-5ubuntu1.9
    • 2.7.0-5ubuntu1.10
    • 2.7.0-5ubuntu1.11
    • 2.7.0-5ubuntu1.12
    Affected ranges
    • ECOSYSTEM: < 2.7.0-5ubuntu1.13

    Update to 2.7.0-5ubuntu1.13

  • jruby Ubuntu:20.04:LTS

    Versions
    • 9.1.17.0-3
    • 9.1.17.0-3build5
    • 9.1.17.0-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.0 Ubuntu:22.04:LTS

    Versions
    • 3.0.2-5ubuntu1
    • 3.0.2-7
    • 3.0.2-7ubuntu2
    • 3.0.2-7ubuntu2.1
    • 3.0.2-7ubuntu2.2
    • 3.0.2-7ubuntu2.3
    • 3.0.2-7ubuntu2.4
    • 3.0.2-7ubuntu2.5
    Affected ranges
    • ECOSYSTEM: < 3.0.2-7ubuntu2.6

    Update to 3.0.2-7ubuntu2.6

  • jruby Ubuntu:24.04:LTS

    Versions
    • 9.3.9.0+ds-1
    • 9.4.5.0+ds-1
    • 9.4.5.0+ds-1ubuntu1
    • 9.4.6.0+ds-1ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.2 Ubuntu:24.04:LTS

    Versions
    • 3.2.3-1
    • 3.2.3-1build2
    • 3.2.3-1build3
    Affected ranges
    • ECOSYSTEM: < 3.2.3-1ubuntu0.24.04.1

    Update to 3.2.3-1ubuntu0.24.04.1

  • jruby Ubuntu:25.10

    Versions
    • 9.4.8.0+ds-2ubuntu1
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.10

    Versions
    • 9.4.8.0+ds-3ubuntu1
    • 9.4.14.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.04:LTS

    Versions
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →