rubyv3_2_0_preview1: 2 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - rubyv3_2_0_preview1

https://github.com/ruby/ruby.git

Library home page: https://github.com/sailfishos-mirror/ruby.git

Vulnerable Source Files (1)

/regexec.c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (rubyv3_2_0_preview1 version)	Remediation Possible**
CVE-2019-16162	High	7.5	rubyv3_2_0_preview1	Direct	ruby - 2.7.1	❌
CVE-2024-27282	Medium	5.5	rubyv3_2_0_preview1	Direct	v3_0_7,v3_1_5,v3_2_4,v3_3_1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-16162

Vulnerable Library - rubyv3_2_0_preview1

https://github.com/ruby/ruby.git

Library home page: https://github.com/sailfishos-mirror/ruby.git

Found in base branch: ruby_2_7

Vulnerable Source Files (1)

/regenc.c

Vulnerability Details

Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.

Publish Date: 2019-09-09

URL: CVE-2019-16162

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-16162

Release Date: 2019-09-10

Fix Resolution: ruby - 2.7.1

Step up your Open Source Security Game with Mend here

CVE-2024-27282

Vulnerable Library - rubyv3_2_0_preview1

https://github.com/ruby/ruby.git

Library home page: https://github.com/sailfishos-mirror/ruby.git

Found in base branch: ruby_2_7

Vulnerable Source Files (1)

/regexec.c

Vulnerability Details

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. This issue is fixed in 3.0.7, 3.1.5, 3.2.4 and 3.3.1.

Publish Date: 2024-02-22

URL: CVE-2024-27282

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/

Release Date: 2024-02-22

Fix Resolution: v3_0_7,v3_1_5,v3_2_4,v3_3_1

Step up your Open Source Security Game with Mend here