CVE-2024-27281

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

Published: Mar 21, 2024 / Updated: 8mo ago

010
CVSS 4.5No EPSS yetMedium
CVE info copied to clipboard

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache. We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to rdoc 6.3.4.1 For Ruby 3.1 users: Update to rdoc 6.4.1.1 For Ruby 3.2 users: Update to rdoc 6.5.1.1 You can use gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile. Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Timeline

First Article

Feedly found the first article mentioning CVE-2024-27281. See article

Mar 21, 2024 at 4:34 AM / Ruby News
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Mar 21, 2024 at 5:10 AM
Vendor Advisory

RedHat CVE advisory released a security advisory (CVE-2024-27281).

Mar 21, 2024 at 6:35 PM
Vendor Advisory

GitHub Advisories released a security advisory.

Mar 25, 2024 at 7:36 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (510830)

Apr 25, 2024 at 5:15 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (194960)

May 4, 2024 at 5:15 AM
CVE Assignment

NVD published the first details for CVE-2024-27281

May 14, 2024 at 3:11 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (207412)

Sep 19, 2024 at 5:17 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (207471)

Sep 20, 2024 at 5:15 AM
Static CVE Timeline Graph

Affected Systems

Tenable/nessus
+null more

Patches

bugzilla.redhat.com
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

Vendor Advisory

Oracle Solaris Third Party Bulletin - April 2024
Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released. Oracle Solaris Third Party Bulletin Risk Matrix (Revision 3: Published on 2024-06-14)

News

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102001)
(When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.
Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102001)
(When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption.
Virt, Pythom, Firefox, and more updates for Oracle Linux
Oracle Linux has received several security updates, including virt:ol and virt-devel:rhel, python3.12, gtk3, xmlsec1, llvm-toolset:ol8, firefox, ruby:3.3, net-snmp, osbuild-composer, git-lfs, kernel, expat, emacs, nano, firewalld, glibc, libuser, avahi, blktrace, libldb, stunnel, gnome-keyring, dovecot, edk2, samba ...
Oracle9: ELSA-2024-6785: ruby:3.3 security Moderate Security Advisory Updates
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:
Oracle Linux 9 : ruby:3.3 (ELSA-2024-6785)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6785 advisory. The remote Oracle Linux host is missing one or more security updates.
See 147 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:High
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:Low
Integrity:Low
Availability Impact:Low

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI