Out-of-bounds read in StringIO - CVE-2024-27280

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87693

Out-of-bounds read in StringIO - CVE-2024-27280

Published: March 21, 2024


Vulnerability identifier: #VU87693
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-27280
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the "ungetbyte" and "ungetc" methods. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.


Affected software

StringIO
Debian Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Anolis OS
macOS
Slackware Linux
Ubuntu
openEuler
Fedora
PeopleSoft Enterprise PeopleTools
JD Edwards EnterpriseOne Tools
rubygem-net-telnet
rubygem-rss
rubygem-abrt-doc
rubygem-abrt
rubygem-xmlrpc
rubygem-io-console
rubygem-mysql2
rubygem-mysql2-doc
rubygem-typeprof
rubygem-pg-doc
rubygem-pg
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-irb
rubygem-rbs
rubygem-racc
rubygem-bundler
rubygem-bundler-doc
rubygem-json
rubygem-openssl
ruby2.5 (Ubuntu package)
rubygem-mongo
rubygem-mongo-doc
ruby-devel
ruby-irb
ruby-help
ruby-debugsource
ruby-debuginfo
ruby
ruby-libs
ruby-doc
rubygems
rubygems-devel
rubygem-psych
ruby-default-gems
ruby3.1 (Debian package)
rubygem-rexml
rubygem-test-unit
ruby-bundled-gems
rubygem-bson
rubygem-bson-doc
rubygem-minitest
rubygem-rdoc
rubygem-rake
Cloud Pak for Network Automation
OpenManage Network Integration (OMNI)
IBM Cloud Pak for Watson AIOps

How to mitigate CVE-2024-27280

Install updates from vendor's website.

StringIO - addressed in versions 3.0.1.1, 3.0.1.2
JD Edwards EnterpriseOne Tools - update to 9.2.9.2
macOS - addressed in versions 14.8 23J21, 15.7 24G222, 26.0 25A354
rubygem-net-telnet - update to 0.1.1-112.0.1
rubygem-net-telnet - update to 0.1.1-122
rubygem-rss - addressed in versions 0.2.9-143.0.1, 0.3.1-3
rubygem-abrt-doc - addressed in versions 0.3.0-4, 0.4.0-1
rubygem-abrt - addressed in versions 0.3.0-4, 0.4.0-1
rubygem-xmlrpc - update to 0.3.0-112.0.1
rubygem-xmlrpc - update to 0.3.0-122
rubygem-io-console - addressed in versions 0.4.6-112.0.1, 0.5.7-143.0.1, 0.7.1-3
rubygem-io-console - update to 0.4.6-122
rubygem-mysql2 - addressed in versions 0.4.10-4, 0.5.3-2.0.1, 0.5.5-1
rubygem-mysql2-doc - addressed in versions 0.4.10-4, 0.5.3-2.0.1, 0.5.5-1
rubygem-typeprof - addressed in versions 0.15.2-143.0.1, 0.21.9-3
rubygem-pg-doc - addressed in versions 1.0.0-3.0.1, 1.2.3-1, 1.5.4-1
rubygem-pg - addressed in versions 1.0.0-3.0.1, 1.2.3-1, 1.5.4-1
rubygem-power_assert - addressed in versions 1.1.1-112.0.1, 1.2.1-143.0.1, 2.0.3-3
rubygem-power_assert - update to 1.1.1-122
rubygem-did_you_mean - update to 1.2.0-112.0.1
rubygem-did_you_mean - update to 1.2.0-122
rubygem-bigdecimal - addressed in versions 1.3.4-112.0.1, 3.0.0-143.0.1, 3.1.5-3
rubygem-bigdecimal - update to 1.3.4-122
rubygem-irb - addressed in versions 1.3.5-143.0.1, 1.13.1-3
rubygem-rbs - addressed in versions 1.4.0-143.0.1, 3.4.0-3
rubygem-racc - update to 1.7.3-3
rubygem-bundler - addressed in versions 1.16.1-4, 2.2.33-143.0.1, 2.5.16-3
rubygem-bundler-doc - update to 1.16.1-4
rubygem-json - addressed in versions 2.1.0-112.0.1, 2.5.1-143.0.1, 2.7.1-3
rubygem-json - update to 2.1.0-122
rubygem-openssl - update to 2.1.2-112.0.1
rubygem-openssl - update to 2.1.2-122
ruby2.5 (Ubuntu package) - addressed in versions 2.5.1-1ubuntu1.16+esm5, 2.7.0-5ubuntu1.18+esm1, 3.0.2-7ubuntu2.11, 3.2.3-1ubuntu0.24.04.6, 3.3.7-1ubuntu2.1
rubygem-mongo - update to 2.5.1-2
rubygem-mongo-doc - update to 2.5.1-2
ruby-devel - update to 2.5.8-122
ruby-irb - update to 2.5.8-122
ruby-help - update to 2.5.8-122
ruby-debugsource - update to 2.5.8-122
ruby-debuginfo - update to 2.5.8-122
ruby - update to 2.5.8-122
ruby - addressed in versions 2.5.9-112.0.1, 3.0.7-143.0.1, 3.3.5-3
ruby-devel - addressed in versions 2.5.9-112.0.1, 3.0.7-143.0.1, 3.3.5-3
ruby-libs - addressed in versions 2.5.9-112.0.1, 3.0.7-143.0.1, 3.3.5-3
ruby-irb - update to 2.5.9-112.0.1
ruby-doc - addressed in versions 2.5.9-112.0.1, 3.0.7-143.0.1, 3.3.5-3
Cloud Pak for Network Automation - update to 2.7.5
rubygems - addressed in versions 2.7.6.3-112.0.1, 3.2.33-143.0.1, 3.5.16-3
rubygems-devel - addressed in versions 2.7.6.3-112.0.1, 3.2.33-143.0.1, 3.5.16-3
rubygems-devel - update to 2.7.6-122
rubygems - update to 2.7.6-122
rubygem-psych - addressed in versions 3.0.2-112.0.1, 3.3.2-143.0.1, 5.1.2-3
rubygem-psych - update to 3.0.2-122
ruby - update to 3.0.7
ruby-default-gems - addressed in versions 3.0.7-143.0.1, 3.3.5-3
ruby3.1 (Debian package) - update to 3.1.2-7+deb12u1
ruby - addressed in versions 3.2.4-182.fc38, 3.2.4-182.fc39, 3.3.1-7.fc40
rubygem-rexml - addressed in versions 3.2.5-143.0.1, 3.3.6-3
rubygem-test-unit - addressed in versions 3.2.7-112.0.1, 3.3.7-143.0.1, 3.6.1-3
rubygem-test-unit - update to 3.2.7-122
ruby-bundled-gems - update to 3.3.5-3
OpenManage Network Integration (OMNI) - update to 3.7
rubygem-bson - update to 4.3.0-2
rubygem-bson-doc - update to 4.3.0-2
IBM Cloud Pak for Watson AIOps - update to 4.6.0
rubygem-minitest - addressed in versions 5.10.3-112.0.1, 5.14.2-143.0.1, 5.20.0-3
rubygem-minitest - update to 5.10.3-122
rubygem-rdoc - addressed in versions 6.0.1.1-112.0.1, 6.3.4.1-143.0.1, 6.6.3.1-3
rubygem-rdoc - update to 6.0.1.1-122
rubygem-rake - update to 12.3.0-122
rubygem-rake - addressed in versions 12.3.3-112.0.1, 13.0.3-143.0.1, 13.1.0-3

External References

Related Security Bulletins