Lucene search

[email protected]CVE-2022-28739

HistoryMay 09, 2022 - 6:15 p.m.

CVE-2022-28739

2022-05-0918:15:08

CWE-125

[email protected]

web.nvd.nist.gov

316

cve-2022-28739

buffer over-read

ruby

string-to-float conversion

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

Affected configurations

NVD

Node

ruby-langrubyRange<2.6.10

ruby-langrubyRange2.7.0–2.7.6

ruby-langrubyRange3.0.0–3.0.4

ruby-langrubyRange3.1.0–3.1.2

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

applemacosRange11.0–11.7.1

applemacosRange12.0–12.6.1

CPENameOperatorVersion
ruby-lang:rubyruby-lang rubylt2.6.10
ruby-lang:rubyruby-lang rubylt2.7.6
ruby-lang:rubyruby-lang rubylt3.0.4
ruby-lang:rubyruby-lang rubylt3.1.2