Re: Is CVE-2024-27281 affecting also 2.x?

[Vít Ondruch]

(Adding ruby-maint ML into CC)

Folks, could somebody help Borja find the answers sooner then me? I have 
to go through my backlog after a few days of PTO.

Thx

Vít

Dne 19. 08. 24 v 7:21 Borja Tarraso Hueso napsal(a):
> Hi Vit,
>
> This is Borja Tarraso from Red Hat Product SecurityI am looking to 
> determine if ruby 2.x is vulnerable for CVE-2024-27281?
>
> In the ruby page, it states the affected versions are 3.0.6 or lower: 
> https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/ 
> https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/The 
> version that puppet is using (ruby 2.7.8p225), it states that 2.7.8 is 
> the last version and vulnerabilities will not be addressed anymore: 
> https://ruby-lang.org/en/news/2023/03/30/ruby-2-7-8-released/ 
> https://ruby-lang.org/en/news/2023/03/30/ruby-2-7-8-released/ :
> "After this release, Ruby 2.7 reaches EOL. In other words, this is 
> expected to be the last release of Ruby 2.7 series. We will not 
> release Ruby 2.7.9 even if a security vulnerability is found (but 
> could release if a severe regression is found). We recommend all Ruby 
> 2.7 users to start migration to Ruby 3.2, 3.1, or 3.0 immediately."
> Though this is not RH, Ubuntu has found that 2.x is also affected: 
> https://ubuntu.com/security/CVE-2024-27281 
> https://ubuntu.com/security/CVE-2024-27281. So I am unsure if 
> CVE-2024-27281 only affects ruby package 3.x only and not 2.x.
>
> But after looking at it a bit more, I think the issue is just 
> impacting ruby 3.0.x as here is the fix: 
> https://github.com/ruby/ruby/commit/ffdf0232efd4955a234955c8372885b850fcfe33 
> https://github.com/ruby/ruby/commit/ffdf0232efd4955a234955c8372885b850fcfe33In 
> ruby 2.7 we do not do *load_file_unsafe* but just *load_file*: 
> https://github.com/ruby/ruby/blob/1f4d4558484b370999954f3ede7e3aa3a3a01ef3/l... 
> https://github.com/ruby/ruby/blob/1f4d4558484b370999954f3ede7e3aa3a3a01ef3/lib/rdoc/rdoc.rb
>
> Then by running git-blame I noticed this was introduced via this 
> commit and this person 3 years ago: 
> https://github.com/ruby/ruby/blame/70613595645fc3ae2bdde8f023728e3f10122ffb/... 
> https://github.com/ruby/ruby/blame/70613595645fc3ae2bdde8f023728e3f10122ffb/ext/psych/lib/psych.rb#L661
>
> So I think it was never implemented, back-ported, or existed in 2.x 
> and ruby 3.0 was already released on 2020-12-25. If you could confirm 
> for the matter of a sanity check?
> Regards,
> Borja Tarraso
>
> Principal Product Security Engineer
>
> Red Hat Nordics