Posted by usa on 14 Sep 2017
There is a buffer underrun vulnerability in OpenSSL bundled by Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-14033.
If a malicious string is passed to the
decode method of
OpenSSL::ASN1, buffer underrun may be caused and the Ruby interpreter may crash.
All users running an affected release should either upgrade or use one of the workarounds immediately.
- Ruby 2.2 series: 2.2.7 and earlier
- Ruby 2.3 series: 2.3.4 and earlier
- Ruby 2.4 series: 2.4.1 and earlier
- prior to trunk revision 56946
The OpenSSL library is also distributed as a gem. If you can’t upgrade Ruby itself, install OpenSSL gem newer than version 2.0.0. But this workaround is only available with Ruby 2.4 series. When using Ruby 2.2 series or 2.3 series, the gem does not override the bundled version of OpenSSL.
Thanks to asac for reporting this issue.
- Originally published at 2017-09-14 12:00:00 (UTC)