Posted by mame on 12 Apr 2022
A buffer-overrun vulnerability is discovered in a conversion algorithm from a String to a Float. This vulnerability has been assigned the CVE identifier CVE-2022-28739. We strongly recommend upgrading Ruby.
Due to a bug in an internal function that converts a String to a Float, some conversion methods like
String#to_f could cause buffer over-read.
A typical consequence is a process termination due to segmentation fault, but under limited circumstances, it may be exploitable for illegal memory read.
Please update Ruby to 2.6.10, 2.7.6, 3.0.4, or 3.1.2.
- ruby 2.6.9 or prior
- ruby 2.7.5 or prior
- ruby 3.0.3 or prior
- ruby 3.1.1 or prior
Thanks to piao for discovering this issue.
- Originally published at 2022-04-12 12:00:00 (UTC)