Bug 2270749 (CVE-2024-27281)
| Summary: | CVE-2024-27281 ruby: RCE vulnerability with .rdoc_options in RDoc | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Zack Miele <zmiele> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anthomas, bbuckingham, bcourt, eglynn, ehelms, ggainey, hhorak, jjoyce, jorton, jschluet, jsherril, juwatts, lhh, lsvaty, lzap, mburns, mgarciac, mhulan, nmoumoul, orabin, osousa, pcreech, pgrist, rchan, rhos-maint, ruby-maint, slinaber, smallamp, tvignaud, vondruch, zbitter |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | rdoc 6.3.4.1, rdoc 6.4.1.1, rdoc 6.5.1.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Rubygem RDoc. When parsing .rdoc_options used for configuration in RDoc as a YAML file there are no restrictions on the classes that can be restored. This issue may lead to object injection, resulting in remote code execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2277054, 2277055, 2270786, 2270787, 2270788, 2270789, 2270790, 2270791, 2270792, 2270793, 2270794, 2270795, 2270796, 2270797, 2270798, 2270799, 2270800, 2270801, 2270802, 2270803, 2270804, 2270805, 2270806, 2270807, 2270808, 2270809, 2270810, 2270811, 2270812, 2270813, 2270814, 2270815, 2270816, 2270817, 2270818, 2270819, 2270820, 2270821, 2270822, 2270823, 2270824, 2270825, 2270826, 2270827, 2270828, 2270829, 2270830, 2270831, 2276875, 2277049, 2277050, 2277051, 2277052, 2277053, 2280544 | ||
| Bug Blocks: | 2270748 | ||
|
Description
Zack Miele
2024-03-21 17:48:54 UTC
Created puppet tracking bugs for this issue: Affects: epel-8 [bug 2270792] Created ruby:3.1/rubygem-pg tracking bugs for this issue: Affects: fedora-38 [bug 2270798] Created rubygem-ammeter tracking bugs for this issue: Affects: fedora-all [bug 2270813] Created rubygem-bcrypt tracking bugs for this issue: Affects: epel-7 [bug 2270787] Created rubygem-bcrypt_pbkdf tracking bugs for this issue: Affects: fedora-all [bug 2270815] Created rubygem-domain_name tracking bugs for this issue: Affects: fedora-38 [bug 2270801] Created rubygem-haml tracking bugs for this issue: Affects: fedora-all [bug 2270817] Created rubygem-highline tracking bugs for this issue: Affects: epel-8 [bug 2270793] Created rubygem-http-cookie tracking bugs for this issue: Affects: fedora-all [bug 2270818] Created rubygem-jquery-rails tracking bugs for this issue: Affects: fedora-38 [bug 2270803] Created rubygem-marc tracking bugs for this issue: Affects: fedora-all [bug 2270819] Created rubygem-mechanize tracking bugs for this issue: Affects: fedora-38 [bug 2270805] Created rubygem-minitest-around tracking bugs for this issue: Affects: fedora-all [bug 2270820] Created rubygem-net-http-persistent tracking bugs for this issue: Affects: fedora-all [bug 2270821] Created rubygem-pdfkit tracking bugs for this issue: Affects: fedora-all [bug 2270822] Created rubygem-pg tracking bugs for this issue: Affects: fedora-all [bug 2270823] Created rubygem-power_assert tracking bugs for this issue: Affects: fedora-all [bug 2270824] Created rubygem-rest-client tracking bugs for this issue: Affects: fedora-all [bug 2270825] Created rubygem-ruby_engine tracking bugs for this issue: Affects: epel-7 [bug 2270788] Affects: fedora-all [bug 2270826] Created rubygem-ruby_version tracking bugs for this issue: Affects: epel-7 [bug 2270789] Affects: fedora-38 [bug 2270808] Created rubygem-shindo tracking bugs for this issue: Affects: fedora-all [bug 2270827] Created rubygem-shoulda-context tracking bugs for this issue: Affects: fedora-all [bug 2270828] Created rubygem-sinatra tracking bugs for this issue: Affects: epel-7 [bug 2270790] Created rubygem-sqlite3 tracking bugs for this issue: Affects: epel-8 [bug 2270794] Affects: fedora-38 [bug 2270810] Created rubygem-stringex tracking bugs for this issue: Affects: fedora-all [bug 2270829] Created rubygem-tins tracking bugs for this issue: Affects: epel-7 [bug 2270791] Affects: fedora-all [bug 2270830] Created rubygem-webmock tracking bugs for this issue: Affects: fedora-all [bug 2270831] Created whatweb tracking bugs for this issue: Affects: epel-8 [bug 2270797] Affects: fedora-all [bug 2270786] I don't think this affects generated documents, only rubygem-rdoc is affected if possible. This is the official announcement: https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/ This is the patch: https://github.com/ruby/rdoc/commit/33221979e3a6a18de962553b56c396abb5ba3244 And I'd like to elaborate that having `.rdoc_options` file around does not mean the package is vulnerable. It could be in theory, but using upstream sources, the chances are minimal. Created ruby tracking bugs for this issue: Affects: fedora-38 [bug 2277049] Affects: fedora-39 [bug 2277051] Affects: fedora-40 [bug 2277052] Created ruby:3.1/ruby tracking bugs for this issue: Affects: fedora-38 [bug 2277050] Created rubygem-rdoc tracking bugs for this issue: Affects: fedora-38 [bug 2277053] Affects: fedora-39 [bug 2277054] Affects: fedora-40 [bug 2277055] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3500 https://access.redhat.com/errata/RHSA-2024:3500 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3546 https://access.redhat.com/errata/RHSA-2024:3546 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:3668 https://access.redhat.com/errata/RHSA-2024:3668 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3670 https://access.redhat.com/errata/RHSA-2024:3670 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:3671 https://access.redhat.com/errata/RHSA-2024:3671 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:3838 https://access.redhat.com/errata/RHSA-2024:3838 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:4499 https://access.redhat.com/errata/RHSA-2024:4499 |