REDHAT-BUG-863484: Low severity Ruby Ruby vulnerability
Originally, Common Vulnerabilities and Exposures assigned an identifier of CVE-2011-1005 to the following vulnerability:
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#tos method, as demonstrated by changing an intended pathname.
with the following upstream patch: [1] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=30903&view=revision
Based on later upstream patch for different (CVE-2012-4464 and CVE-2012-4466) issues: [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
it was found that original upstream 1.8.x ruby patch for CVE-2011-1005 issue was not complete, when the NameError#tos() method was used on / with Ruby objects (the test logic in 'testtostaintnesspropagation' test from [1] was actually reversed, so the test returned success also on still vulnerable instances).
Acknowledgements:
This issue was discovered by Vit Ondruch of Red Hat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-863484?
The severity of REDHAT-BUG-863484 is categorized as critical due to the potential for exploit and unauthorized access.
How do I fix REDHAT-BUG-863484?
To fix REDHAT-BUG-863484, upgrade Ruby to a version that is not vulnerable, specifically above 1.8.7-330.
Which versions of Ruby are affected by REDHAT-BUG-863484?
Ruby versions 1.8.6 up to 1.8.7-330 and 1.8.8dev are affected by REDHAT-BUG-863484.
What vulnerabilities are associated with REDHAT-BUG-863484?
REDHAT-BUG-863484 is associated with CVE-2011-1005, which affects the safe-level feature in Ruby.
Is there a workaround for REDHAT-BUG-863484?
There is no known workaround for REDHAT-BUG-863484; updating to a patched Ruby version is recommended.