DeutschShown in its original language — a full translation is planned for a future version.
Ruby: Mehrere Schwachstellen
view advisory published 2017-09-14
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, einen Denial of Service Angriff durchzuführen oder Sicherheitsmechanismen zu umgehen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-14033US | high7.5 | — | ||
The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) vi… | ||||
| CVE-2017-10784US | high8.8 | — | ||
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequen… | ||||
| CVE-2017-0898US | critical9.1 | — | ||
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer… | ||||
02
references
External citations — patches, advisories, analysis.
- CentOS Security Advisory CESA-2018:0378 vom 2018-03-10external
- Oracle Linux Security Advisory ELSA-2018-0378 vom 2018-03-01external
- SUSE Security Update SUSE-SU-2020:1570-1 vom 2020-06-09external
- Red Hat Security Advisory RHSA-2018:0583 vom 2018-03-26external
- Red Hat Security Advisory RHSA-2018:0585 vom 2018-03-26external
- Ubuntu Security Notice USN-3439-1 vom 2017-10-05external
- Ubuntu Security Notice USN-3528-1 vom 2018-01-10external
- Red Hat Security Advisory RHSA-2017:3485 vom 2017-12-19external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan