CVE-2022-28738

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted...

Original description

The description as published by the source.

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami ruby-min

[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"},{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]

Bitnami ruby

[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"},{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2022-28738 ruby Fixed in: 3.0.4-r0

References

advisory hackerone.com
advisory security-tracker.debian.org
advisory security.netapp.com
advisory ruby-lang.org
web security.gentoo.org
web nvd.nist.gov