UBUNTU-CVE-2024-27281

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2024-27281

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-27281.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-27281

Related

Published

2024-05-14T15:11:00Z

Modified

2024-05-14T15:11:00Z

Summary

[none]

Details

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.

References

Affected packages

Ubuntu:Pro:14.04:LTS / jruby

Package

Name: jruby

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.6-5ubuntu1

1.5.6-6

1.5.6-7

1.5.6-9+deb8u2build0.14.04.1~esm2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / ruby2.3

Package

Name: ruby2.3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.0-1

2.3.0-2

2.3.0-4ubuntu2

2.3.0-4ubuntu3

2.3.0-5ubuntu1

2.3.1-2~16.04

2.3.1-2~16.04.2

2.3.1-2~16.04.4

2.3.1-2~16.04.5

2.3.1-2~16.04.6

2.3.1-2~16.04.7

2.3.1-2~16.04.9

2.3.1-2~16.04.10

2.3.1-2~16.04.11

2.3.1-2~16.04.12

2.3.1-2~ubuntu16.04.13

2.3.1-2~ubuntu16.04.14

2.3.1-2~ubuntu16.04.15

2.3.1-2~ubuntu16.04.16

2.3.1-2~ubuntu16.04.16+esm1

2.3.1-2~ubuntu16.04.16+esm2

2.3.1-2~ubuntu16.04.16+esm3

2.3.1-2~ubuntu16.04.16+esm4

2.3.1-2~ubuntu16.04.16+esm5

2.3.1-2~ubuntu16.04.16+esm6

2.3.1-2~ubuntu16.04.16+esm7

2.3.1-2~ubuntu16.04.16+esm8

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / jruby

Package

Name: jruby

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.7.21-2ubuntu4

1.7.22-1ubuntu1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / ruby2.5

Package

Name: ruby2.5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.5.0~preview1-1ubuntu2

2.5.0-4ubuntu1

2.5.0-4ubuntu4

2.5.0-5ubuntu1

2.5.0-6ubuntu1

2.5.1-1ubuntu1

2.5.1-1ubuntu1.1

2.5.1-1ubuntu1.2

2.5.1-1ubuntu1.4

2.5.1-1ubuntu1.5

2.5.1-1ubuntu1.6

2.5.1-1ubuntu1.7

2.5.1-1ubuntu1.8

2.5.1-1ubuntu1.9

2.5.1-1ubuntu1.10

2.5.1-1ubuntu1.11

2.5.1-1ubuntu1.12

2.5.1-1ubuntu1.13

2.5.1-1ubuntu1.14

2.5.1-1ubuntu1.15

2.5.1-1ubuntu1.16

2.5.1-1ubuntu1.16+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / jruby

Package

Name: jruby

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.1.13.0-1

9.1.17.0-1~18.04

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / jruby

Package

Name: jruby

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.1.17.0-3

9.1.17.0-3build5

9.1.17.0-3build6

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / ruby2.7

Package

Name: ruby2.7
Purl: pkg:deb/ubuntu/ruby2.7@2.7.0-5ubuntu1.13?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.0-5ubuntu1.13

Affected versions

2.*

2.7.0-1

2.7.0-2

2.7.0-3

2.7.0-4

2.7.0-4ubuntu1

2.7.0-5ubuntu1

2.7.0-5ubuntu1.1

2.7.0-5ubuntu1.2

2.7.0-5ubuntu1.3

2.7.0-5ubuntu1.4

2.7.0-5ubuntu1.5

2.7.0-5ubuntu1.6

2.7.0-5ubuntu1.7

2.7.0-5ubuntu1.8

2.7.0-5ubuntu1.9

2.7.0-5ubuntu1.10

2.7.0-5ubuntu1.11

2.7.0-5ubuntu1.12

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "ruby2.7-doc": "2.7.0-5ubuntu1.13",
            "ruby2.7-dbgsym": "2.7.0-5ubuntu1.13",
            "ruby2.7": "2.7.0-5ubuntu1.13",
            "libruby2.7": "2.7.0-5ubuntu1.13",
            "libruby2.7-dbgsym": "2.7.0-5ubuntu1.13",
            "ruby2.7-dev": "2.7.0-5ubuntu1.13"
        }
    ]
}

Ubuntu:22.04:LTS / ruby3.0

Package

Name: ruby3.0
Purl: pkg:deb/ubuntu/ruby3.0@3.0.2-7ubuntu2.6?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.2-7ubuntu2.6

Affected versions

3.*

3.0.2-5ubuntu1

3.0.2-7

3.0.2-7ubuntu2

3.0.2-7ubuntu2.1

3.0.2-7ubuntu2.2

3.0.2-7ubuntu2.3

3.0.2-7ubuntu2.4

3.0.2-7ubuntu2.5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "ruby3.0-dev": "3.0.2-7ubuntu2.6",
            "ruby3.0": "3.0.2-7ubuntu2.6",
            "ruby3.0-doc": "3.0.2-7ubuntu2.6",
            "libruby3.0": "3.0.2-7ubuntu2.6",
            "libruby3.0-dbgsym": "3.0.2-7ubuntu2.6",
            "ruby3.0-dbgsym": "3.0.2-7ubuntu2.6"
        }
    ]
}

Ubuntu:24.04:LTS / jruby

Package

Name: jruby

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.3.9.0+ds-1

9.4.5.0+ds-1

9.4.5.0+ds-1ubuntu1

9.4.6.0+ds-1ubuntu3

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / ruby3.2

Package

Name: ruby3.2
Purl: pkg:deb/ubuntu/ruby3.2@3.2.3-1ubuntu0.24.04.1?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.2.3-1ubuntu0.24.04.1

Affected versions

3.*

3.2.3-1

3.2.3-1build2

3.2.3-1build3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "ruby3.2-dbgsym": "3.2.3-1ubuntu0.24.04.1",
            "ruby3.2-doc": "3.2.3-1ubuntu0.24.04.1",
            "libruby3.2": "3.2.3-1ubuntu0.24.04.1",
            "ruby3.2-dev": "3.2.3-1ubuntu0.24.04.1",
            "ruby3.2": "3.2.3-1ubuntu0.24.04.1",
            "libruby3.2-dbgsym": "3.2.3-1ubuntu0.24.04.1"
        }
    ]
}