Skip to content

Commit ad8b416

Browse files
unakunak
committed
Drafts
1 parent e43e510 commit ad8b416

12 files changed

+526
-0
lines changed

‎en/news/_posts/2017-09-14-json-heap-exposure-cve-2017-14064.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-14064: Heap exposure vulnerability in generating JSON"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
There is a heap exposure vulnerability in JSON bundled by Ruby.
12+
This vulnerability has been assgined the CVE identifier [CVE-2017-14064](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033).
13+
14+
## Details
15+
16+
The `generate` method of `JSON` module optionally accepts an instance of `JSON::Ext::Generator::State` class.
17+
If a malcious instance is passed, the result may include contents of heap.
18+
19+
All users running an affected release should either upgrade or use one of the workarounds immediately.
20+
21+
## Affected Versions
22+
23+
* Ruby 2.2 series: 2.2.7 and earlier
24+
* Ruby 2.3 series: 2.3.4 and earlier
25+
* Ruby 2.4 series: 2.4.1 and earlier
26+
* prior to trunk revision XXXXX
27+
28+
## Workaround
29+
30+
The JSON library is also distributed as a gem.
31+
If you can't upgrade Ruby itself, install JSON gem newer than version 2.0.4.
32+
33+
## Credit
34+
35+
Thanks to [ahmadsherif](https://hackerone.com/ahmadsherif) for reporting this issue.
36+
37+
## History
38+
39+
* Originally published at 2017-09-14 12:00:00 (UTC)

‎en/news/_posts/2017-09-14-openssl-asn1-buffer-underrun-cve-2017-14033.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 docode"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
There is a buffer underrun vulnerability in OpenSSL bundled by Ruby.
12+
This vulnerability has been assgined the CVE identifier [CVE-2017-14033](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033).
13+
14+
## Details
15+
16+
If a malicious string is passed to the `decode` method of `OpenSSL::ASN1`, buffer underrun may be caused and the Ruby interpreter may crash.
17+
18+
All users running an affected release should either upgrade or use one of the workarounds immediately.
19+
20+
## Affected Versions
21+
22+
* Ruby 2.2 series: 2.2.7 and earlier
23+
* Ruby 2.3 series: 2.3.4 and earlier
24+
* Ruby 2.4 series: 2.4.1 and earlier
25+
* prior to trunk revision XXXXX
26+
27+
## Workaround
28+
29+
The OpenSSL library is also distributed as a gem.
30+
If you can't upgrade Ruby itself, install OpenSSL gem newer than version 2.0.0.
31+
But this workaround is only available with Ruby 2.4 series.
32+
When using Ruby 2.2 series or 2.3 series, the gem does not override the bundled version of OpenSSL.
33+
34+
## Credit
35+
36+
Thanks to [asac](https://hackerone.com/asac) for reporting this issue.
37+
38+
## History
39+
40+
* Originally published at 2017-09-14 12:00:00 (UTC)

‎en/news/_posts/2017-09-14-ruby-2-2-8-released.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.2.8 Released"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.2.8 has been released.
11+
This release includes several security fixes.
12+
Please check the topics below for details.
13+
14+
* [CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf](/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/)
15+
* [CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick](/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/)
16+
* [CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 docode](/ja/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/)
17+
* [CVE-2017-14064: Heap exposure vulnerability in generating JSON](/ja/news/2017/09/14/json-heap-exposure-cve-2017-14064/)
18+
* [Multiple vulnerabilities in RubyGems](/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/)
19+
* Updated bundled libyaml to version 0.1.7
20+
21+
See the [ChangeLog]() for details.
22+
23+
## Download
24+
25+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.tar.bz2](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.tar.bz2)
26+
27+
SIZE: NNNN bytes
28+
SHA1: XXXX
29+
SHA256: XXXX
30+
SHA512: XXXX
31+
32+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.tar.gz](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.tar.gz)
33+
34+
SIZE: NNNN bytes
35+
SHA1: XXXX
36+
SHA256: XXXX
37+
SHA512: XXXX
38+
39+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.tar.xz](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.tar.xz)
40+
41+
SIZE: NNNN bytes
42+
SHA1: XXXX
43+
SHA256: XXXX
44+
SHA512: XXXX
45+
46+
* [https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.zip](https://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.8.zip)
47+
48+
SIZE: NNNN bytes
49+
SHA1: XXXX
50+
SHA256: XXXX
51+
SHA512: XXXX
52+
53+
## Release Comment
54+
55+
Thanks to everyone who helped with this release, especially, reports of vulnerabilities.

‎en/news/_posts/2017-09-14-ruby-2-3-5-released.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.3.5 Released"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.3.5 has been released.
11+
12+
This release includes about 70 bug fixes after the previous release, and also includes several security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf](/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/)
16+
* [CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick](/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/)
17+
* [CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 docode](/ja/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/)
18+
* [CVE-2017-14064: Heap exposure vulnerability in generating JSON](/ja/news/2017/09/14/json-heap-exposure-cve-2017-14064/)
19+
* [Multiple vulnerabilities in RubyGems](/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/)
20+
* Updated bundled libyaml to version 0.1.7
21+
22+
See the [ChangeLog](http://svn.ruby-lang.org/repos/ruby/tags/v2_3_5/ChangeLog) for details.
23+
24+
## Download
25+
26+
* [https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.tar.bz2](https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.tar.bz2)
27+
28+
SIZE: NNNN bytes
29+
SHA1: XXXX
30+
SHA256: XXXX
31+
SHA512: XXXX
32+
33+
* [https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.tar.gz](https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.tar.gz)
34+
35+
SIZE: NNNN bytes
36+
SHA1: XXXX
37+
SHA256: XXXX
38+
SHA512: XXXX
39+
40+
* [https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.tar.xz](https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.tar.xz)
41+
42+
SIZE: NNNN bytes
43+
SHA1: XXXX
44+
SHA256: XXXX
45+
SHA512: XXXX
46+
47+
* [https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.zip](https://cache.ruby-lang.org/pub/ruby/2.3/ruby-2.3.5.zip)
48+
49+
SIZE: NNNN bytes
50+
SHA1: XXXX
51+
SHA256: XXXX
52+
SHA512: XXXX
53+
54+
## Release Comment
55+
56+
Thanks to everyone who helped with this release.
57+
58+
The maintenance of Ruby 2.3, including this release, is based on the “Agreement for the Ruby stable version” of the Ruby Association.

‎en/news/_posts/2017-09-14-sprintf-buffer-underrun-cve-2017-0898.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
There is a buffer underrun vulnerability in the `sprintf` method of `Kernel` module.
12+
This vulnerability has been assgined the CVE identifier [CVE-2017-0898](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898).
13+
14+
## Details
15+
16+
If a malcious format string which contains a precious specifier (`*`) is passed and a huge minus value is also passed to the specifier, buffer underrun may be caused.
17+
In such situcation, the result may contains heap, or the Ruby interpreter may crash.
18+
19+
All users running an affected release should upgrade immediately.
20+
21+
## Affected Versions
22+
23+
* Ruby 2.2 series: 2.2.7 and earlier
24+
* Ruby 2.3 series: 2.3.4 and earlier
25+
* Ruby 2.4 series: 2.4.1 and earlier
26+
* prior to trunk revision XXXXX
27+
28+
## Credit
29+
30+
Thanks to [aerodudrizzt](https://hackerone.com/aerodudrizzt) for reporting this issue.
31+
32+
## History
33+
34+
* Originally published at 2017-09-14 12:00:00 (UTC)

‎en/news/_posts/2017-09-14-webrick-basic-auth-escape-sequence-injection-cve-2017-10784.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
There is an escape sequence injection vulnerabirity in the Basic authentication of WEBrick bundled by Ruby.
12+
This vulnerability has been assgined the CVE identifier [CVE-2017-10784](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10784).
13+
14+
## Details
15+
16+
When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name.
17+
WEBrick outputs the passed user name intact to its log, then an attacker can inject malcious escape sequences to the log and dangerours control characters may be executed on a victim's terminal emulator.
18+
19+
This vulnerability is similar to [a vulnerability already fixed](/en/news/2010/01/10/webrick-escape-sequence-injection/), but it had not been fixed in the Basic authentication.
20+
21+
All users running an affected release should upgrade immediately.
22+
23+
## Affected Versions
24+
25+
* Ruby 2.2 series: 2.2.7 and earlier
26+
* Ruby 2.3 series: 2.3.4 and earlier
27+
* Ruby 2.4 series: 2.4.1 and earlier
28+
* prior to trunk revision XXXXX
29+
30+
## Credit
31+
32+
Thanks to Yusuke Endoh <[email protected]> for reporting this issue.
33+
34+
## History
35+
36+
* Originally published at 2017-09-14 12:00:00 (UTC)

‎ja/news/_posts/2017-09-14-json-heap-exposure-cve-2017-14064.md

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-14064: JSON の生成時におけるヒープ暴露について"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
tags: security
8+
lang: ja
9+
---
10+
11+
Ruby の標準添付ライブラリである JSON の `JSON` モジュールの `generate` メソッドにおいて、特殊な引数を渡された場合に、状況によってはヒープの中身が外部から閲覧可能となりうるという脆弱性が発見されました。
12+
この脆弱性は、[CVE-2017-14064](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033) として登録されています。
13+
14+
## 詳細
15+
16+
`JSON` モジュールの `generate` メソッドにおいて、第二引数として `JSON::Ext::Generator::State` クラスのインスタンスを渡すことができますが、特別な調整がされたインスタンスを渡した場合、ヒープの中身が暴露された状態で JSON 文字列が出力される場合がありました。
17+
18+
この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新するか、または下記の回避策を取ってください。
19+
20+
## 影響を受けるバージョン
21+
22+
* Ruby 2.2.7 以前の全ての Ruby 2.2 系列
23+
* Ruby 2.3.4 以前の全ての Ruby 2.3 系列
24+
* Ruby 2.4.1 以前の全ての Ruby 2.4 系列
25+
* revision XXXXX より前の開発版
26+
27+
## 回避策
28+
29+
JSON ライブラリは gem としても配布されています。
30+
Ruby 全体を更新できない事情がある場合は、バージョン 2.0.4 以降の JSON gem をインストールしてください。
31+
32+
## クレジット
33+
34+
この脆弱性情報は、[ahmadsherif](https://hackerone.com/ahmadsherif) 氏によって報告されました。
35+
36+
## 更新履歴
37+
38+
* 2017-09-14 21:00:00 (JST) 初版

‎ja/news/_posts/2017-09-14-openssl-asn1-buffer-underrun-cve-2017-14033.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2017-14033: OpenSSL の ASN1 デコードにおけるバッファーアンダーランについて"
4+
author: "usa"
5+
translator:
6+
date: 2017-09-14 12:00:00 +0000
7+
tags: security
8+
lang: ja
9+
---
10+
11+
Ruby の標準添付ライブラリである OpenSSL の `OpenSSL::ASN1` モジュールの `decode` メソッドにおいて、特殊な引数を渡された場合に、バッファーアンダーランが発生し、状況によってはヒープの中身が外部から閲覧可能となりうるという脆弱性が発見されました。
12+
この脆弱性は、[CVE-2017-14033](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033) として登録されています。
13+
14+
## 詳細
15+
16+
`OpenSSL::ASN1` モジュールの `decode` メソッドにおいて、特殊な文字列が引数として与えられた場合に、バッファーアンダーランが発生していました。
17+
この時、Ruby インタプリタがクラッシュする場合がありました。
18+
19+
この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新するか、または下記の回避策を取ってください。
20+
21+
## 影響を受けるバージョン
22+
23+
* Ruby 2.2.7 以前の全ての Ruby 2.2 系列
24+
* Ruby 2.3.4 以前の全ての Ruby 2.3 系列
25+
* Ruby 2.4.1 以前の全ての Ruby 2.4 系列
26+
* revision XXXXX より前の開発版
27+
28+
## 回避策
29+
30+
OpenSSL ライブラリは gem としても配布されています。
31+
Ruby 2.4 系列であれば、この問題が修正されたバージョン 2.0.0 以降の OpenSSL gem をインストールすることによっても、標準添付されている版を置き換えることができます。
32+
Ruby 2.2・2.3 系列の場合は、OpenSSL gem をインストールしても、通常は標準添付されている版が使用されてしまいますのでご注意ください。
33+
34+
## クレジット
35+
36+
この脆弱性情報は、[asac](https://hackerone.com/asac) 氏によって報告されました。
37+
38+
## 更新履歴
39+
40+
* 2017-09-14 21:00:00 (JST) 初版

0 commit comments

Comments
 (0)