CVE-2014-2734: Medium severity ruby-lang Ruby vulnerability
DISPUTED The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2734?
CVE-2014-2734 is considered a medium severity vulnerability due to potential spoofing risks.
How do I fix CVE-2014-2734?
To remediate CVE-2014-2734, upgrade Ruby to a version that includes the fix for this vulnerability.
Which versions of Ruby are affected by CVE-2014-2734?
CVE-2014-2734 affects Ruby versions 2.0.x and 2.1.x.
Can CVE-2014-2734 lead to remote attacks?
Yes, CVE-2014-2734 allows remote attackers to spoof signatures, creating a potential remote exploitation vector.
Is CVE-2014-2734 a persistent vulnerability?
CVE-2014-2734 is not persistent as it requires specific conditions related to file handling in Ruby.