Posted by usa on 14 Sep 2017
There is a buffer underrun vulnerability in OpenSSL bundled by Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-14033.
Details
If a malicious string is passed to the decode method of OpenSSL::ASN1, buffer underrun may be caused and the Ruby interpreter may crash.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Affected Versions
- Ruby 2.2 series: 2.2.7 and earlier
- Ruby 2.3 series: 2.3.4 and earlier
- Ruby 2.4 series: 2.4.1 and earlier
- prior to trunk revision 56946
Workaround
The OpenSSL library is also distributed as a gem. If you can’t upgrade Ruby itself, install OpenSSL gem newer than version 2.0.0. But this workaround is only available with Ruby 2.4 series. When using Ruby 2.2 series or 2.3 series, the gem does not override the bundled version of OpenSSL.
Credit
Thanks to asac for reporting this issue.
History
- Originally published at 2017-09-14 12:00:00 (UTC)