It was discovered that the Net::IMAP client in Ruby did not properly sanitize Symbol arguments passed to IMAP commands. A remote attacker controlling a malicious IMAP server, or able to influence command arguments, could use this to inject arbitrary IMAP commands via CRLF sequences. (CVE-2026-42258) It was discovered that the Zlib::GzipReader in Ruby did not correctly ensure sufficient buffer capacity in the zstreambufferungets function. An attacker could use this to craft a gzip stream that, when processed, could cause a buffer overflow, resulting in memory corruption and possibly arbitrary code execution. (CVE-2026-27820)
Summary When verifying SSL certificates, jruby-openssl is not verifying that the hostname presented in the certificate matches the one we are trying to connect to, meaning a MITM could just present any valid cert for a completely different domain they own, and JRuby wouldn't complain.
Details n/a
PoC An example domain bad.substitutealert.com was created to present the a certificate for the domain s8a.me. The following script run in IRB in CRuby 3.4.3 will fail with certificate verify failed (hostname mismatch), but will work just fine in JRuby 10.0.0.0 and JRuby 9.4.2.0, both of which use jruby-openssl version 0.15.3
ruby require "net/http" require "openssl"
uri = URI("https://bad.substitutealert.com/") https = Net::HTTP.new(uri.host, uri.port) https.usessl = true https.verifymode = OpenSSL::SSL::VERIFYPEER
body = https.start { https.get(uri.requesturi).body } puts body
Impact Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely
A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to CGI.escapehtml on a platform where long type takes 4 bytes, typically, Windows.
Reference: https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escapehtml-cve-2021-41816/
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
End of life: 4/23/2024, Latest version: 3.0.7
End of life: 4/23/2024, Latest version: 3.0.7
End of life: 3/31/2023, Latest version: 2.7.8
End of life: 3/31/2023, Latest version: 2.7.8
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
ruby193 uses an insecure LDLIBRARYPATH setting.
End of life: 3/31/2022, Latest version: 2.6.10
End of life: 3/31/2022, Latest version: 2.6.10
Array#pack method converts the receiver’s contents into a string with specified format. If the receiver contains some tainted objects, the returned string also should be tainted. String#unpack method which converts the receiver into an array also should propagate its tainted flag to the objects contained in the returned array. But, with B, b, H and h directives, the tainted flags are not propagated. So, if a script processes unreliable inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags, the check might be wrong.
External References:
https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
End of life: 3/31/2021, Latest version: 2.5.9
End of life: 3/31/2021, Latest version: 2.5.9
The lazyinitialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Upstream bug:
https://github.com/ruby/ruby/pull/1777
Upstream patch:
https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7
The URI.decodewwwformcomponent method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
The parseryyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script, related to the parsertokaddutf8 function in parse.y. NOTE: this might have security relevance as a bypass of a $SAFE protection mechanism.
Last updated 24 July 2024
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigencunicodegetcasefoldcodesbystr() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicodeunfoldkey(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expandcasefoldstring() during the call to onigencunicodegetcasefoldcodesbystr(), a typical stack buffer overflow.
Last updated 24 July 2024
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "argtypes" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
Type confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.
End of life: 3/31/2020, Latest version: 2.4.10
End of life: 3/31/2020, Latest version: 2.4.10
End of life: 3/31/2019, Latest version: 2.3.8
End of life: 3/31/2019, Latest version: 2.3.8
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
End of life: 3/31/2018, Latest version: 2.2.10