PT-2014-4891 · Ruby+2 · Ruby+2

Emboss · Published 2014-04-24 · Updated 2025-09-29 · CVE-2014-2734

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 2.x

Description The issue concerns the openssl extension in Ruby, which does not properly maintain the state of process memory after a file is reopened. This allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. The issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration contains errors and redundant or unnecessarily-complex code.

Recommendations For Ruby version 2.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

ALSA-2025_16880

ALT-PU-2016-2061

CVE-2014-2734

Affected Products

Alt Linux

Openssl

Ruby

References · 12

• 🔥 http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html · Exploit
• 🔥 https://github.com/adrienthebo/cve-2014-2734 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Apr/231 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2734 · Security Note
• https://ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734 · Note
• https://news.ycombinator.com/item?id=7601973 · Note
• https://t.me/cvenotify/89371 · Telegram Post
• https://gist.github.com/10446549 · Note
• https://gist.github.com/emboss/91696b56cd227c8a0c13 · Note
• http://securityfocus.com/bid/66956 · Note
• http://osvdb.org/106006 · Note
• http://seclists.org/fulldisclosure/2014/May/13 · Note