PT-2024-2478 · Ruby+9 · Stringio+9
David_H1
·
Published
2024-03-19
·
Updated
2025-09-29
·
CVE-2024-27280
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ruby StringIO versions 3.0.1 through 3.0.6
Ruby StringIO versions 3.1.x through 3.1.4
Description
A buffer-overread issue was discovered in StringIO, where the
ungetbyte and ungetc methods can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This issue is related to a data leak vulnerability.Recommendations
For Ruby 3.0 users, update to
stringio 3.0.1.1
For Ruby 3.1 users, update to stringio 3.1.0.2
Update the StringIO gem to version 3.0.3 or later
Use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.Exploit
Fix
DoS
Buffer Over-read
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Stringio
Ubuntu