NetSight
IP …
critical9.8

CVE-2024-27280

StringIO buffer overread vulnerability

Impact

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The `ungetbyte` and `ungetc` methods on a StringIO can read past the end of a string, and a subsequent call to `StringIO.gets` may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: * For Ruby 3.0 users: Update to `stringio` 3.0.1.1 * For Ruby 3.1 users: Update to `stringio` 3.1.0.2 You can use `gem update stringio` to update it. If you are using bundler, please add `gem "stringio", ">= 3.0.1.2"` to your `Gemfile`.

Affected packages

EcosystemPackageAffectedFixed in
rubygemsstringio< 3.0.1.13.0.1.1

Affected products

ProductAffected versions
Ruby 3.0.X
through 3.0.6
3.1.X
through 3.1.4.

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-120CWE-126

References