Lucene search

K
nvd[email protected]NVD:CVE-2024-27282
HistoryMay 14, 2024 - 3:11 p.m.

CVE-2024-27282

2024-05-1415:11:57
web.nvd.nist.gov
ruby
version 3.x
regex compiler
arbitrary
heap data
extraction
fixed
versions 3.0.7
3.1.5
3.2.4
3.3.1

6.7 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.