CoreCVE
Back

CRITICAL

ruby: Buffer underrun vulnerability in Kernel.sprintf

Published Sep 15, 2017

Description

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

Affected products

Remediation

Red Hat statement

This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Weaknesses (2)

CWE-122

CWE-134

References (17)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hackerone
Published Sep 15, 2017
Updated Sep 17, 2024
Reserved Nov 30, 2016
Link CVE-2017-0898
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-0898
Red Hat
Severity Moderate
Public date Sep 14, 2017
Links CVE-2017-0898 - Bugzilla