PT-2014-4891 · Ruby+2 · Ruby+2

Emboss · Publicado 2014-04-24 · Atualizado 2025-09-29 · CVE-2014-2734

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 2.x

Description The issue concerns the openssl extension in Ruby, which does not properly maintain the state of process memory after a file is reopened. This allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. The issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration contains errors and redundant or unnecessarily-complex code.

Recommendations For Ruby version 2.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2016-2061

CVE-2014-2734

Produtos afetados

Alt Linux

Openssl

Ruby

Referências · 12

• 🔥 http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html · Exploit
• 🔥 https://github.com/adrienthebo/cve-2014-2734 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Apr/231 · Exploit
• https://ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2734 · Nota de Segurança
• https://news.ycombinator.com/item?id=7601973 · Nota
• https://t.me/cvenotify/89371 · Publicação no Telegram
• https://gist.github.com/10446549 · Nota
• https://gist.github.com/emboss/91696b56cd227c8a0c13 · Nota
• http://securityfocus.com/bid/66956 · Nota
• http://osvdb.org/106006 · Nota
• http://seclists.org/fulldisclosure/2014/May/13 · Nota