Buffer-Overread Vulnerability in Ruby's StringIO
CVE-2024-27280
9.8CRITICAL
What is CVE-2024-27280?
A buffer-overread issue has been identified in the StringIO module of Ruby, affecting versions from 3.0.x to 3.1.x. The flaw allows the ungetbyte and ungetc methods to read bytes beyond the end of a string, which may expose sensitive memory values if the StringIO.gets method is subsequently invoked. The main fixed version for StringIO is 3.0.3, with additional fixes provided for Ruby 3.0 users via StringIO 3.0.1.1 and for Ruby 3.1 users via StringIO 3.0.1.2. Users are advised to update to the relevant patched versions to mitigate the associated security risks.