Bug 1561948 (CVE-2018-8779)
Summary: | CVE-2018-8779 ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | bkearney, cbillett, ccoleman, cpelland, dajohnso, dedgar, dmcphers, gblomqui, gmccullo, gtanzill, hhorak, hhudgeon, jaruga, jfrey, jgoulding, jhardy, jorton, jprause, mtasaka, obarenbo, pvalena, roliveri, ruby-maint, simaishi, s, strzibny, tomckay, vanmeeuwen+fedora, vondruch |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | ruby 2.2.10, ruby 2.3.7, ruby 2.4.4, ruby 2.5.1 | Doc Type: | If docs needed, set a value |
Doc Text: |
It was found that the UNIXSocket::open and UNIXServer::open ruby methods did not handle the NULL byte properly. An attacker, able to inject NULL bytes in the socket path, could possibly trigger an unspecified behavior of the ruby script.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-06-10 10:19:05 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1561956, 1561957, 1561958, 1563873, 1563874, 1565258, 1569024, 1569025, 1569026, 1569027, 1569028, 1651798, 1652037, 1652038 | ||
Bug Blocks: | 1561954 |
Description
Adam Mariš
2018-03-29 09:07:36 UTC
Created ruby tracking bugs for this issue: Affects: fedora-all [bug 1561957] Mitigation: It is possible to test for presence of the NULL byte manually prior to call the affected methods. ruby version 1.8 does not appear to be vulnerable : the method correctly triggers an ArgumentError. Statement: This issue did not affect the versions of ruby as shipped with Red Hat Enterprise Linux 5 and 6. > Upstream fix : > https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=62991 Above shows r62991. It is better to add r63000 too. trunk branch r62991: https://github.com/ruby/ruby/commit/8794dec6a5f11adc5cdd19a5ee91ea6b0816763f r63000: https://github.com/ruby/ruby/commit/b78fa27ae0b717c5569878c106a67d5047e5fb88 > Ruby 2.2 series: 2.2.9 and earlier ruby_2_2 branch: A commit merged from both r62991 and r63000. https://github.com/ruby/ruby/commit/47165eed264d357e78e27371cfef20d5c2bde5d9 > Ruby 2.3 series: 2.3.6 and earlier > Ruby 2.4 series: 2.4.3 and earlier > Ruby 2.5 series: 2.5.0 and earlier Search by below string. ``` merge revision(s) 62991,63000: unixsocket.c: check NUL bytes unixsocket.c: abstract namespace ``` This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3729 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3730 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2018:3731 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2028 https://access.redhat.com/errata/RHSA-2019:2028 |