Skip to content

Commit 02e249d

Browse files
riseshiariseshia
committed
Copy from origin news at 2024-04-23
1 parent e9a9a8c commit 02e249d

5 files changed

+242
-0
lines changed

‎ko/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search"
4+
author: "hsbt"
5+
translator:
6+
date: 2024-04-23 10:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
We have released the Ruby version 3.0.7, 3.1.5, 3.2.4 and 3.3.1 that have a security fix for an arbitrary memory address read vulnerability in Regex search.
12+
This vulnerability has been assigned the CVE identifier [CVE-2024-27282](https://www.cve.org/CVERecord?id=CVE-2024-27282).
13+
14+
## Details
15+
16+
An issue was discovered in Ruby 3.x through 3.3.0.
17+
18+
If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings.
19+
20+
## Recommended action
21+
22+
We recommend to update the Ruby to version 3.3.1 or later. In order to ensure compatibility with older Ruby series, you may update as follows instead:
23+
24+
* For Ruby 3.0 users: Update to 3.0.7
25+
* For Ruby 3.1 users: Update to 3.1.5
26+
* For Ruby 3.2 users: Update to 3.2.4
27+
* For Ruby 3.3 users: Update to 3.3.1
28+
29+
## Affected versions
30+
31+
* Ruby 3.0.6 or lower
32+
* Ruby 3.1.4 or lower
33+
* Ruby 3.2.3 or lower
34+
* Ruby 3.3.0
35+
36+
## Credits
37+
38+
Thanks to [sp2ip](https://hackerone.com/sp2ip?type=user) for discovering this issue.
39+
40+
## History
41+
42+
* Originally published at 2024-04-23 10:00:00 (UTC)

‎ko/news/_posts/2024-04-23-ruby-3-0-7-released.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.0.7 Released"
4+
author: "hsbt"
5+
translator:
6+
date: 2024-04-23 10:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.0.7 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search]({%link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %})
16+
* [CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc](https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/)
17+
* [CVE-2024-27280: Buffer overread vulnerability in StringIO](https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/)
18+
19+
See the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_0_7) for further details.
20+
21+
After this release, Ruby 3.0 reaches EOL. In other words, this is expected to be the last release of Ruby 3.0 series.
22+
We will not release Ruby 3.0.8 even if a security vulnerability is found (but could release if a severe regression is found).
23+
We recommend all Ruby 3.0 users to start migration to Ruby 3.3, 3.2, or 3.1 immediately.
24+
25+
## Download
26+
27+
{% assign release = site.data.releases | where: "version", "3.0.7" | first %}
28+
29+
* <{{ release.url.gz }}>
30+
31+
SIZE: {{ release.size.gz }}
32+
SHA1: {{ release.sha1.gz }}
33+
SHA256: {{ release.sha256.gz }}
34+
SHA512: {{ release.sha512.gz }}
35+
36+
* <{{ release.url.xz }}>
37+
38+
SIZE: {{ release.size.xz }}
39+
SHA1: {{ release.sha1.xz }}
40+
SHA256: {{ release.sha256.xz }}
41+
SHA512: {{ release.sha512.xz }}
42+
43+
* <{{ release.url.zip }}>
44+
45+
SIZE: {{ release.size.zip }}
46+
SHA1: {{ release.sha1.zip }}
47+
SHA256: {{ release.sha256.zip }}
48+
SHA512: {{ release.sha512.zip }}
49+
50+
## Release Comment
51+
52+
Many committers, developers, and users who provided bug reports helped us make this release.
53+
Thanks for their contributions.

‎ko/news/_posts/2024-04-23-ruby-3-1-5-released.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.1.5 Released"
4+
author: "hsbt"
5+
translator:
6+
date: 2024-04-23 10:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.1.5 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search]({%link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %})
16+
* [CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc](https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/)
17+
* [CVE-2024-27280: Buffer overread vulnerability in StringIO](https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/)
18+
19+
See the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_1_5) for further details.
20+
21+
## Download
22+
23+
{% assign release = site.data.releases | where: "version", "3.1.5" | first %}
24+
25+
* <{{ release.url.gz }}>
26+
27+
SIZE: {{ release.size.gz }}
28+
SHA1: {{ release.sha1.gz }}
29+
SHA256: {{ release.sha256.gz }}
30+
SHA512: {{ release.sha512.gz }}
31+
32+
* <{{ release.url.xz }}>
33+
34+
SIZE: {{ release.size.xz }}
35+
SHA1: {{ release.sha1.xz }}
36+
SHA256: {{ release.sha256.xz }}
37+
SHA512: {{ release.sha512.xz }}
38+
39+
* <{{ release.url.zip }}>
40+
41+
SIZE: {{ release.size.zip }}
42+
SHA1: {{ release.sha1.zip }}
43+
SHA256: {{ release.sha256.zip }}
44+
SHA512: {{ release.sha512.zip }}
45+
46+
## Release Comment
47+
48+
Many committers, developers, and users who provided bug reports helped us make this release.
49+
Thanks for their contributions.

‎ko/news/_posts/2024-04-23-ruby-3-2-4-released.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.2.4 Released"
4+
author: "nagachika"
5+
translator:
6+
date: 2024-04-23 10:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.2.4 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search]({%link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %})
16+
* [CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc](https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/)
17+
* [CVE-2024-27280: Buffer overread vulnerability in StringIO](https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/)
18+
19+
See the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_2_4) for further details.
20+
21+
## Download
22+
23+
{% assign release = site.data.releases | where: "version", "3.2.4" | first %}
24+
25+
* <{{ release.url.gz }}>
26+
27+
SIZE: {{ release.size.gz }}
28+
SHA1: {{ release.sha1.gz }}
29+
SHA256: {{ release.sha256.gz }}
30+
SHA512: {{ release.sha512.gz }}
31+
32+
* <{{ release.url.xz }}>
33+
34+
SIZE: {{ release.size.xz }}
35+
SHA1: {{ release.sha1.xz }}
36+
SHA256: {{ release.sha256.xz }}
37+
SHA512: {{ release.sha512.xz }}
38+
39+
* <{{ release.url.zip }}>
40+
41+
SIZE: {{ release.size.zip }}
42+
SHA1: {{ release.sha1.zip }}
43+
SHA256: {{ release.sha256.zip }}
44+
SHA512: {{ release.sha512.zip }}
45+
46+
## Release Comment
47+
48+
Many committers, developers, and users who provided bug reports helped us make this release.
49+
Thanks for their contributions.

‎ko/news/_posts/2024-04-23-ruby-3-3-1-released.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.3.1 Released"
4+
author: "naruse"
5+
translator:
6+
date: 2024-04-23 10:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.3.1 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search]({%link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %})
16+
* [CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc](https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/)
17+
* [CVE-2024-27280: Buffer overread vulnerability in StringIO](https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/)
18+
19+
See the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_3_1) for further details.
20+
21+
## Download
22+
23+
{% assign release = site.data.releases | where: "version", "3.3.1" | first %}
24+
25+
* <{{ release.url.gz }}>
26+
27+
SIZE: {{ release.size.gz }}
28+
SHA1: {{ release.sha1.gz }}
29+
SHA256: {{ release.sha256.gz }}
30+
SHA512: {{ release.sha512.gz }}
31+
32+
* <{{ release.url.xz }}>
33+
34+
SIZE: {{ release.size.xz }}
35+
SHA1: {{ release.sha1.xz }}
36+
SHA256: {{ release.sha256.xz }}
37+
SHA512: {{ release.sha512.xz }}
38+
39+
* <{{ release.url.zip }}>
40+
41+
SIZE: {{ release.size.zip }}
42+
SHA1: {{ release.sha1.zip }}
43+
SHA256: {{ release.sha256.zip }}
44+
SHA512: {{ release.sha512.zip }}
45+
46+
## Release Comment
47+
48+
Many committers, developers, and users who provided bug reports helped us make this release.
49+
Thanks for their contributions.

0 commit comments

Comments
 (0)