CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode

Posted by usa on 14 Sep 2017

There is a buffer underrun vulnerability in OpenSSL bundled by Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-14033.

Details

If a malicious string is passed to the decode method of OpenSSL::ASN1, buffer underrun may be caused and the Ruby interpreter may crash.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected Versions

• Ruby 2.2 series: 2.2.7 and earlier
• Ruby 2.3 series: 2.3.4 and earlier
• Ruby 2.4 series: 2.4.1 and earlier
• prior to trunk revision 56946

Workaround

The OpenSSL library is also distributed as a gem. If you can’t upgrade Ruby itself, install OpenSSL gem newer than version 2.0.0. But this workaround is only available with Ruby 2.4 series. When using Ruby 2.2 series or 2.3 series, the gem does not override the bundled version of OpenSSL.

Credit

Thanks to asac for reporting this issue.

History

• Originally published at 2017-09-14 12:00:00 (UTC)