critique
CVE-2017-0898
ruby: Buffer underrun vulnerability in Kernel.sprintf
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat6.5CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Oracle (élevée), Red Hat (moyenne), Amazon (moyenne), Ubuntu (moyenne).
Description
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | ruby | 2.4.2-1.ph1 |
| Photon OS 2.0 | ruby | 2.4.2-1.ph2 |
| alpine 3.10 | ruby | 2.4.2-r0 |
| alpine 3.11 | ruby | 2.4.2-r0 |
| alpine 3.12 | ruby | 2.4.2-r0 |
| alpine 3.13 | ruby | 2.4.2-r0 |
| alpine 3.14 | ruby | 2.4.2-r0 |
| alpine 3.15 | ruby | 2.4.2-r0 |
| alpine 3.16 | ruby | 2.4.2-r0 |
| alpine 3.17 | ruby | 2.4.2-r0 |
| alpine 3.18 | ruby | 2.4.2-r0 |
| alpine 3.19 | ruby | 2.4.2-r0 |
Afficher les 89 entrées de 34 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | ruby | 2.4.2-1.ph1 |
| Photon OS 2.0 | ruby | 2.4.2-1.ph2 |
| alpine 3.10 | ruby | 2.4.2-r0 |
| alpine 3.11 | ruby | 2.4.2-r0 |
| alpine 3.12 | ruby | 2.4.2-r0 |
| alpine 3.13 | ruby | 2.4.2-r0 |
| alpine 3.14 | ruby | 2.4.2-r0 |
| alpine 3.15 | ruby | 2.4.2-r0 |
| alpine 3.16 | ruby | 2.4.2-r0 |
| alpine 3.17 | ruby | 2.4.2-r0 |
| alpine 3.18 | ruby | 2.4.2-r0 |
| alpine 3.19 | ruby | 2.4.2-r0 |
| alpine 3.20 | ruby | 2.4.2-r0 |
| alpine 3.21 | ruby | 2.4.2-r0 |
| alpine 3.22 | ruby | 2.4.2-r0 |
| alpine 3.23 | ruby | 2.4.2-r0 |
| alpine 3.24 | ruby | 2.4.2-r0 |
| alpine 3.3 | ruby | 2.2.8-r0 |
| alpine 3.4 | ruby | 2.3.5-r0 |
| alpine 3.5 | ruby | 2.3.5-r0 |
| alpine 3.5 | ruby2.2 | 2.2.8-r0 |
| alpine 3.6 | ruby | 2.4.2-r0 |
| alpine 3.6 | ruby2.2 | 2.2.8-r0 |
| alpine 3.7 | ruby | 2.4.2-r0 |
| alpine 3.8 | ruby | 2.4.2-r0 |
| alpine 3.9 | ruby | 2.4.2-r0 |
| alpine edge | ruby | 2.4.2-r0 |
| amazon linux 1 | ruby22 | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby23 | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby24 | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.9.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.9.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.9.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.17.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.17.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.17.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.17.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.17.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.0-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.4.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.9.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.9.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.1-1.17.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.1-1.17.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.13-1.30.4.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.13-1.30.4.amzn1 |
| debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u4 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u6 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u2 |
| Oracle Linux 7 | ruby | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-33.el7_4 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-33.el7_4 |
| Oracle Linux 7 | rubygem-json | 1.7.7-33.el7_4 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-33.el7_4 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-33.el7_4 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-33.el7_4 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-33.el7_4 |
| Oracle Linux 7 | rubygems | 2.0.14.1-33.el7_4 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-33.el7_4 |
| ubuntu 14.04 | ruby1.9.1 | 1.9.3.484-2ubuntu1.5 |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.10 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.10 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.10 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.6 |
Références
- http://www.securityfocus.com/bid/100862
- http://www.securitytracker.com/id/1039363
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/security/cve/CVE-2017-0898
- https://github.com/mruby/mruby/issues/3722
Les 20 références
- https://hackerone.com/reports/212241
- https://linux.oracle.com/cve/CVE-2017-0898.html
- https://linux.oracle.com/errata/ELSA-2018-0378.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-0898
- https://security.gentoo.org/glsa/201710-18
- https://ubuntu.com/security/notices/USN-3439-1
- https://ubuntu.com/security/notices/USN-3685-1
- https://usn.ubuntu.com/3685-1/
- https://www.cve.org/CVERecord?id=CVE-2017-0898
- https://www.debian.org/security/2017/dsa-4031
- https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/