Buffer under-read in Ruby - CVE-2018-8778

Vulnerability identifier: #VU11540

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8778

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the String#unpack method due to buffer under-read. A remote attacker can gain access to potentially sensitive information.

Ruby
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
macOS
Slackware Linux
Opensuse
Fedora
EMC Integrated Data Protection Appliance
ruby (Red Hat package)
ruby (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
ruby
Dell EMC Data Protection Search

Update to versions 2.2.10, 2.3.7, 2.4.4 or 2.5.1.

EMC Integrated Data Protection Appliance - update to 2.7.1
ruby (Red Hat package) - addressed in versions 2.0.0.648-36.el7_4, 2.0.0.648-36.el7_5, 2.0.0.648-37.el7_6
ruby (Alpine package) - update to 2.3.7-r0
Dell EMC Data Protection Search - update to 19.6.0
ruby - addressed in versions 2.4.4-88.fc26, 2.4.4-88.fc27, 2.4.4-89.fc27, 2.5.1-92.fc28

• https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/

• Slackware Linux update for ruby
• Debian update for ruby2.3
• Multiple vulnerabilities in Apple MacOS
• Red Hat update for ruby
• Red Hat update for ruby
• Red Hat update for ruby
• Red Hat update for ruby
• OpenSUSE Linux update for ruby-bundled-gems-rpmhelper, ruby2.5
• Red Hat Enterprise Linux 7 update for ruby
• Red Hat Enterprise Linux 7 update for ruby
• Red Hat Enterprise Linux 7 update for ruby
• Buffer under-read in ruby (Alpine package)
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC Data Protection Search
• Fedora 28 update for ruby
• Fedora 26 update for ruby
• Fedora 27 update for ruby
• Fedora 27 update for ruby