Skip to content

Commit 3b2d8ca

Browse files
unakunak
authored
Security announcement (#1761)
* Security announcement * Ruby 2.2.10 announcement * Ruby 2.3.7 announcement * _data (2.5.1, 2.4.4, 2.3.7 and 2.2.10)
1 parent e307af6 commit 3b2d8ca

19 files changed

+735
-5
lines changed

‎_data/branches.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
- name: 2.3
2727
status: normal maintenance
2828
date: 2015-12-25
29-
eol_date:
29+
eol_date: scheduled for 2019-03-31
3030

3131
- name: 2.2
3232
status: security maintenance

‎_data/downloads.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ preview:
88

99
stable:
1010

11-
- 2.5.0
12-
- 2.4.3
13-
- 2.3.6
11+
- 2.5.1
12+
- 2.4.4
13+
- 2.3.7
1414

1515
# optional
1616
security_maintenance:
1717

18-
- 2.2.9
18+
- 2.2.10
1919

2020
# optional
2121
eol:

‎_data/releases.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,20 @@
3737

3838
# 2.5 series
3939

40+
- version: 2.5.1
41+
date: 2018-03-28
42+
post: /en/news/2018/03/28/ruby-2-5-1-released/
43+
url:
44+
gz: https://cache.ruby-lang.org/pub/ruby/2.5/ruby-2.5.1.tar.gz
45+
zip: https://cache.ruby-lang.org/pub/ruby/2.5/ruby-2.5.1.zip
46+
bz2: https://cache.ruby-lang.org/pub/ruby/2.5/ruby-2.5.1.tar.bz2
47+
xz: https://cache.ruby-lang.org/pub/ruby/2.5/ruby-2.5.1.tar.xz
48+
sha256:
49+
gz: dac81822325b79c3ba9532b048c2123357d3310b2b40024202f360251d9829b1
50+
zip: 5d8e490896c8353aa574be56ca9aa52c250390e76e36cd23df450c0434ada4d4
51+
bz2: 0f5d20f012baca865381a055e73f22db814615fee3c68083182cb78a4b3b30cb
52+
xz: 886ac5eed41e3b5fc699be837b0087a6a5a3d10f464087560d2d21b3e71b754d
53+
4054
- version: 2.5.0
4155
date: 2017-12-25
4256
post: /en/news/2017/12/25/ruby-2-5-0-released/
@@ -81,6 +95,20 @@
8195

8296
# 2.4 series
8397

98+
- version: 2.4.4
99+
date: 2018-03-28
100+
post: /en/news/2018/03/28/ruby-2-4-4-released/
101+
url:
102+
bz2: https://cache.ruby-lang.org/pub/ruby/2.4/ruby-2.4.4.tar.bz2
103+
gz: https://cache.ruby-lang.org/pub/ruby/2.4/ruby-2.4.4.tar.gz
104+
xz: https://cache.ruby-lang.org/pub/ruby/2.4/ruby-2.4.4.tar.xz
105+
zip: https://cache.ruby-lang.org/pub/ruby/2.4/ruby-2.4.4.zip
106+
sha256:
107+
bz2: 45a8de577471b90dc4838c5ef26aeb253a56002896189055a44dc680644243f1
108+
gz: 254f1c1a79e4cc814d1e7320bc5bdd995dc57e08727d30a767664619a9c8ae5a
109+
xz: 1d0034071d675193ca769f64c91827e5f54cb3a7962316a41d5217c7bc6949f0
110+
zip: d0ca0561be0045f2e094f2ba94f1585e66e9c1e91fe6de3f3035f4d67dce7650
111+
84112
- version: 2.4.3
85113
date: 2017-12-14
86114
post: /en/news/2017/12/14/ruby-2-4-3-released/
@@ -130,6 +158,20 @@
130158

131159
# 2.3 series
132160

161+
- version: 2.3.7
162+
date: 2018-03-28
163+
post: /en/news/2018/03/28/ruby-2-3-7-released/
164+
url:
165+
bz2: https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.7.tar.bz2
166+
gz: https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.7.tar.gz
167+
xz: https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.7.tar.xz
168+
zip: https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.7.zip
169+
sha256:
170+
bz2: 18b12fafaf37d5f6c7139c1b445355aec76baa625a40300598a6c8597fc04d8e
171+
gz: 35cd349cddf78e4a0640d28ec8c7e88a2ae0db51ebd8926cd232bb70db2c7d7f
172+
xz: c61f8f2b9d3ffff5567e186421fa191f0d5e7c2b189b426bb84498825d548edb
173+
zip: ffa42eeff928624a05dc7ad39426c855c6e9a757417f17b6fe9e54664ec91012
174+
133175
- version: 2.3.6
134176
date: 2017-12-14
135177
post: /en/news/2017/12/14/ruby-2-3-6-released/
@@ -182,6 +224,20 @@
182224

183225
# 2.2 series
184226

227+
- version: 2.2.10
228+
date: 2018-03-28
229+
post: /en/news/2018/03/28/ruby-2-2-10-released/
230+
url:
231+
bz2: https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.bz2
232+
gz: https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.gz
233+
xz: https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.xz
234+
zip: https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.zip
235+
sha256:
236+
bz2: a54204d2728283c9eff0cf81d654f245fa5b3447d0824f1a6bc3b2c5c827381e
237+
gz: cd51019eb9d9c786d6cb178c37f6812d8a41d6914a1edaf0050c051c75d7c358
238+
xz: bf77bcb7e6666ccae8d0882ea12b05f382f963f0a9a5285a328760c06a9ab650
239+
zip: 6933eb989afb1b916c438d8eeecff1cfb0a6569c07e7190beca56b10b822207a
240+
185241
- version: 2.2.9
186242
date: 2017-12-14
187243
post: /en/news/2017/12/14/ruby-2-2-9-released/

‎en/news/_posts/2018-03-28-buffer-under-read-unpack-cve-2018-8778.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2018-8778: Buffer under-read in String#unpack"
4+
author: "usa"
5+
date: 2018-03-28 14:00:00 +0000
6+
tags: security
7+
lang: en
8+
---
9+
10+
There is a buffer under-read vulnerability in `String#unpack` method.
11+
This vulnerability has been assigned the CVE identifier [CVE-2018-8778](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8778).
12+
13+
## Details
14+
15+
`String#unpack` receives format specifiers as its parameter, and can be specified the position of parsing the data by the specifier `@`.
16+
If a big number is passed with `@`, the number is treated as the negative value, and out-of-buffer read is occurred.
17+
So, if a script accepts an external input as the argument of `String#unpack`, the attacker can read data on heaps.
18+
19+
All users running an affected release should upgrade immediately.
20+
21+
## Affected Versions
22+
23+
* Ruby 2.2 series: 2.2.9 and earlier
24+
* Ruby 2.3 series: 2.3.6 and earlier
25+
* Ruby 2.4 series: 2.4.3 and earlier
26+
* Ruby 2.5 series: 2.5.0 and earlier
27+
* Ruby 2.6 series: 2.6.0-preview1
28+
* prior to trunk revision r62992
29+
30+
## Credit
31+
32+
Thanks to [aerodudrizzt](https://hackerone.com/aerodudrizzt) for reporting the issue.
33+
34+
## History
35+
36+
* Originally published at 2018-03-28 14:00:00 (UTC)

‎en/news/_posts/2018-03-28-http-response-splitting-in-webrick-cve-2017-17742.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-17742: HTTP response splitting in WEBrick"
4+
author: "usa"
5+
date: 2018-03-28 14:00:00 +0000
6+
tags: security
7+
lang: en
8+
---
9+
10+
There is an HTTP response splitting vulnerability in WEBrick bundled with Ruby.
11+
This vulnerability has been assigned the CVE identifier [CVE-2017-17742](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17742).
12+
13+
## Details
14+
15+
If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients.
16+
17+
All users running an affected release should upgrade immediately.
18+
19+
## Affected Versions
20+
21+
* Ruby 2.2 series: 2.2.9 and earlier
22+
* Ruby 2.3 series: 2.3.6 and earlier
23+
* Ruby 2.4 series: 2.4.3 and earlier
24+
* Ruby 2.5 series: 2.5.0 and earlier
25+
* Ruby 2.6 series: 2.6.0-preview1
26+
* prior to trunk revision r62968
27+
28+
## Credit
29+
30+
Thanks to Aaron Patterson <tenderlove@ruby-lang.org> for reporting the issue.
31+
32+
## History
33+
34+
* Originally published at 2018-03-28 14:00:00 (UTC)

‎en/news/_posts/2018-03-28-large-request-dos-in-webrick-cve-2018-8777.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2018-8777: DoS by large request in WEBrick"
4+
author: "usa"
5+
date: 2018-03-28 14:00:00 +0000
6+
tags: security
7+
lang: en
8+
---
9+
10+
There is a out-of-memory DoS vulnerability with a large request in WEBrick bundled with Ruby.
11+
This vulnerability has been assigned the CVE identifier [CVE-2018-8777](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8777).
12+
13+
## Details
14+
15+
If an attacker sends a large request which contains huge HTTP headers, WEBrick try to process it on memory, so the request causes the out-of-memory DoS attack.
16+
17+
All users running an affected release should upgrade immediately.
18+
19+
## Affected Versions
20+
21+
* Ruby 2.2 series: 2.2.9 and earlier
22+
* Ruby 2.3 series: 2.3.6 and earlier
23+
* Ruby 2.4 series: 2.4.3 and earlier
24+
* Ruby 2.5 series: 2.5.0 and earlier
25+
* Ruby 2.6 series: 2.6.0-preview1
26+
* prior to trunk revision r62965
27+
28+
## Credit
29+
30+
Thanks to Eric Wong <e@80x24.org> for reporting the issue.
31+
32+
## History
33+
34+
* Originally published at 2018-03-28 14:00:00 (UTC)

‎en/news/_posts/2018-03-28-poisoned-nul-byte-dir-cve-2018-8780.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir"
4+
author: "usa"
5+
date: 2018-03-28 14:00:00 +0000
6+
tags: security
7+
lang: en
8+
---
9+
10+
There is an unintentional directory traversal in some methods in `Dir`.
11+
This vulnerability has been assigned the CVE identifier [CVE-2018-8780](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8780).
12+
13+
## Details
14+
15+
`Dir.open`, `Dir.new`, `Dir.entries` and `Dir.empty?` accept the path of the target directory as their parameter.
16+
If the parameter contains NUL (`\0`) bytes, these methods recognize that the path is completed before the NUL bytes.
17+
So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.
18+
19+
All users running an affected release should upgrade immediately.
20+
21+
## Affected Versions
22+
23+
* Ruby 2.2 series: 2.2.9 and earlier
24+
* Ruby 2.3 series: 2.3.6 and earlier
25+
* Ruby 2.4 series: 2.4.3 and earlier
26+
* Ruby 2.5 series: 2.5.0 and earlier
27+
* Ruby 2.6 series: 2.6.0-preview1
28+
* prior to trunk revision r62989
29+
30+
## Credit
31+
32+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting the issue.
33+
34+
## History
35+
36+
* Originally published at 2018-03-28 14:00:00 (UTC)

‎en/news/_posts/2018-03-28-poisoned-nul-byte-unixsocket-cve-2018-8779.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket"
4+
author: "usa"
5+
date: 2018-03-28 14:00:00 +0000
6+
tags: security
7+
lang: en
8+
---
9+
10+
There is a unintentional socket creation vulnerability in `UNIXServer.open` method of socket library bundled with Ruby.
11+
And there is also a unintentional socket access vulnerability in `UNIXSocket.open` method.
12+
This vulnerability has been assigned the CVE identifier [CVE-2018-8779](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8779).
13+
14+
## Details
15+
16+
`UNIXServer.open` accepts the path of the socket to be created at the first parameter.
17+
If the path contains NUL (`\0`) bytes, this method recognize that the path is completed before the NUL bytes.
18+
So, if a script accepts an external input as the argument of this method, the attacker can make the socket file in the unintentional path.
19+
And, `UNIXSocket.open` also accepts the path of the socket to be created at the first parameter without checking NUL bytes like `UNIXServer.open`.
20+
So, if a script accepts an external input as the argument of this method, the attacker can accepts the socket file in the unintentional path.
21+
22+
All users running an affected release should upgrade immediately.
23+
24+
## Affected Versions
25+
26+
* Ruby 2.2 series: 2.2.9 and earlier
27+
* Ruby 2.3 series: 2.3.6 and earlier
28+
* Ruby 2.4 series: 2.4.3 and earlier
29+
* Ruby 2.5 series: 2.5.0 and earlier
30+
* Ruby 2.6 series: 2.6.0-preview1
31+
* prior to trunk revision r62991
32+
33+
## Credit
34+
35+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting the issue.
36+
37+
## History
38+
39+
* Originally published at 2018-03-28 14:00:00 (UTC)

‎en/news/_posts/2018-03-28-ruby-2-2-10-released.md

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.2.10 Released"
4+
author: "usa"
5+
translator:
6+
date: 2018-03-28 17:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.2.10 has been released.
11+
This release includes several security fixes.
12+
Please check the topics below for details.
13+
14+
* [CVE-2017-17742: HTTP response splitting in WEBrick](/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/)
15+
* [CVE-2018-8777: DoS by large request in WEBrick](/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/)
16+
* [CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir](/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/)
17+
* [CVE-2018-8778: Buffer under-read in String#unpack](/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/)
18+
* [CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket](/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/)
19+
* [CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir](/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/)
20+
* [Multiple vulnerabilities in RubyGems](/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/)
21+
22+
Ruby 2.2 is under the state of the security maintenance phase, until the end of the March of 2018.
23+
After the date, maintenance of Ruby 2.2 will be ended.
24+
So, this release is expected to be the last release of Ruby 2.2.
25+
We will never make a new release of Ruby 2.2 unless Ruby 2.2.10 has a serious regression bug.
26+
We recommend you migrating to newer versions of Ruby, such as 2.5.
27+
28+
## Download
29+
30+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.bz2](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.bz2)
31+
32+
SIZE: 13365461 bytes
33+
SHA1: 72ee1dcfd96199d2c3092b77db7a7f439c0abd08
34+
SHA256: a54204d2728283c9eff0cf81d654f245fa5b3447d0824f1a6bc3b2c5c827381e
35+
SHA512: f8ec96c2a5f4ecf22052ee0b1029989ded52d7bf5d41be24fef67e732e76f72119302240bca08f0547510a9cd29e941a32e263cad9c8a2bf80023d6bc97b2373
36+
37+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.gz](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.gz)
38+
39+
SIZE: 16694179 bytes
40+
SHA1: b0207c861f3fa41cbe4909ecb89bd2fcac81fe7c
41+
SHA256: cd51019eb9d9c786d6cb178c37f6812d8a41d6914a1edaf0050c051c75d7c358
42+
SHA512: 051124922240d2e20e74903b9c629fa897279072d2aa9b0a4e3a02331b843fa9c97c16e7073d6faec1b9f2024c3a7e36346014c30eee256f0715c5de226b5db8
43+
44+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.xz](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.tar.xz)
45+
46+
SIZE: 10508612 bytes
47+
SHA1: c46737f81df819c3d7423df5c644431b3fcb8fee
48+
SHA256: bf77bcb7e6666ccae8d0882ea12b05f382f963f0a9a5285a328760c06a9ab650
49+
SHA512: 1f35458f2b1c334e64aecf42cd1df3b223fef119b6ad23394285d9f2e72da26b3ba5418950694c4a8c0b4afc43672f78459f2f7281a595cff0967eb239662ae4
50+
51+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.zip](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.10.zip)
52+
53+
SIZE: 18540424 bytes
54+
SHA1: 0f4b9c6695d000cb456fe8b89f8bf6d42fb95069
55+
SHA256: 6933eb989afb1b916c438d8eeecff1cfb0a6569c07e7190beca56b10b822207a
56+
SHA512: dfaa9a76170b0eed9cb2bf41178f2193dd3428492413b1616aaabd67ec35b9b7705b422b0fdfe38b18a1800bbce3ba161b53d229d307ea7f5c0269ef3d031980
57+
58+
## Release Comment
59+
60+
Thanks to everyone who reported vulnerabilities, fixed the vulnerabilities and helped with this release.

0 commit comments

Comments
 (0)