Skip to content

Commit ae61184

Browse files
riseshiariseshia
committed
Copy related news from en
1 parent e2de8b4 commit ae61184

6 files changed

+289
-0
lines changed

‎ko/news/_posts/2022-04-12-buffer-overrun-in-string-to-float-cve-2022-28739.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2022-28739: Buffer overrun in String-to-Float conversion"
4+
author: "mame"
5+
translator:
6+
date: 2022-04-12 12:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
A buffer-overrun vulnerability is discovered in a conversion algorithm from a String to a Float.
12+
This vulnerability has been assigned the CVE identifier [CVE-2022-28739](https://nvd.nist.gov/vuln/detail/CVE-2022-28739).
13+
We strongly recommend upgrading Ruby.
14+
15+
## Details
16+
17+
Due to a bug in an internal function that converts a String to a Float, some conversion methods like `Kernel#Float` and `String#to_f` could cause buffer over-read.
18+
A typical consequence is a process termination due to segmentation fault, but under limited circumstances, it may be exploitable for illegal memory read.
19+
20+
Please update Ruby to 2.6.10, 2.7.6, 3.0.4, or 3.1.2.
21+
22+
## Affected versions
23+
24+
* ruby 2.6.9 or prior
25+
* ruby 2.7.5 or prior
26+
* ruby 3.0.3 or prior
27+
* ruby 3.1.1 or prior
28+
29+
## Credits
30+
31+
Thanks to [piao](https://hackerone.com/piao?type=user) for discovering this issue.
32+
33+
## History
34+
35+
* Originally published at 2022-04-12 12:00:00 (UTC)

‎ko/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2022-28738: Double free in Regexp compilation"
4+
author: "mame"
5+
translator:
6+
date: 2022-04-12 12:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
A double-free vulnerability is discovered in Regexp compilation.
12+
This vulnerability has been assigned the CVE identifier [CVE-2022-28738](https://nvd.nist.gov/vuln/detail/CVE-2022-28738).
13+
We strongly recommend upgrading Ruby.
14+
15+
## Details
16+
17+
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a "double free" vulnerability.
18+
Note that, in general, it is considered unsafe to create and use a Regexp object generated from untrusted input. In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability.
19+
20+
Please update Ruby to 3.0.4, or 3.1.2.
21+
22+
## Affected versions
23+
24+
* ruby 3.0.3 or prior
25+
* ruby 3.1.1 or prior
26+
27+
Note that ruby 2.6 series and 2.7 series are not affected.
28+
29+
## Credits
30+
31+
Thanks to [piao](https://hackerone.com/piao?type=user) for discovering this issue.
32+
33+
## History
34+
35+
* Originally published at 2022-04-12 12:00:00 (UTC)

‎ko/news/_posts/2022-04-12-ruby-2-6-10-released.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.6.10 Released"
4+
author: "usa and mame"
5+
translator:
6+
date: 2022-04-12 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.6.10 has been released.
11+
12+
This release includes a security fix.
13+
Please check the topics below for details.
14+
15+
* [CVE-2022-28739: Buffer overrun in String-to-Float conversion]({%link en/news/_posts/2022-04-12-buffer-overrun-in-string-to-float-cve-2022-28739.md %})
16+
17+
This release also includes a fix of a build problem with very old compilers and a fix of a regression of date library.
18+
See the [commit logs](https://github.com/ruby/ruby/compare/v2_6_9...v2_6_10) for further details.
19+
20+
After this release, Ruby 2.6 reaches EOL. In other words, this is expected to be the last release of Ruby 2.6 series.
21+
We will not release Ruby 2.6.11 even if a security vulnerability is found (but could release if a severe regression is found).
22+
We recommend all Ruby 2.6 users to start migration to Ruby 3.1, 3.0, or 2.7 immediately.
23+
24+
## Download
25+
26+
{% assign release = site.data.releases | where: "version", "2.6.10" | first %}
27+
28+
* <{{ release.url.bz2 }}>
29+
30+
SIZE: {{ release.size.bz2 }}
31+
SHA1: {{ release.sha1.bz2 }}
32+
SHA256: {{ release.sha256.bz2 }}
33+
SHA512: {{ release.sha512.bz2 }}
34+
35+
* <{{ release.url.gz }}>
36+
37+
SIZE: {{ release.size.gz }}
38+
SHA1: {{ release.sha1.gz }}
39+
SHA256: {{ release.sha256.gz }}
40+
SHA512: {{ release.sha512.gz }}
41+
42+
* <{{ release.url.xz }}>
43+
44+
SIZE: {{ release.size.xz }}
45+
SHA1: {{ release.sha1.xz }}
46+
SHA256: {{ release.sha256.xz }}
47+
SHA512: {{ release.sha512.xz }}
48+
49+
* <{{ release.url.zip }}>
50+
51+
SIZE: {{ release.size.zip }}
52+
SHA1: {{ release.sha1.zip }}
53+
SHA256: {{ release.sha256.zip }}
54+
SHA512: {{ release.sha512.zip }}
55+
56+
## Release Comment
57+
58+
Many committers, developers, and users who provided bug reports helped us make this release.
59+
Thanks for their contributions.

‎ko/news/_posts/2022-04-12-ruby-2-7-6-released.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.7.6 Released"
4+
author: "usa and mame"
5+
translator:
6+
date: 2022-04-12 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.7.6 has been released.
11+
12+
This release includes a security fix.
13+
Please check the topics below for details.
14+
15+
* [CVE-2022-28739: Buffer overrun in String-to-Float conversion]({%link en/news/_posts/2022-04-12-buffer-overrun-in-string-to-float-cve-2022-28739.md %})
16+
17+
This release also includes some bug fixes.
18+
See the [commit logs](https://github.com/ruby/ruby/compare/v2_7_5...v2_7_6) for further details.
19+
20+
After this release, we end the normal maintenance phase of Ruby 2.7, and Ruby 2.7 enters the security maintenance phase.
21+
This means that we will no longer backport any bug fixes to Ruby 2.7 except security fixes.
22+
23+
The term of the security maintenance phase is scheduled for a year.
24+
Ruby 2.7 reaches EOL and its official support ends by the end of the security maintenance phase.
25+
Therefore, we recommend that you start to plan upgrade to Ruby 3.0 or 3.1.
26+
27+
## Download
28+
29+
{% assign release = site.data.releases | where: "version", "2.7.6" | first %}
30+
31+
* <{{ release.url.bz2 }}>
32+
33+
SIZE: {{ release.size.bz2 }}
34+
SHA1: {{ release.sha1.bz2 }}
35+
SHA256: {{ release.sha256.bz2 }}
36+
SHA512: {{ release.sha512.bz2 }}
37+
38+
* <{{ release.url.gz }}>
39+
40+
SIZE: {{ release.size.gz }}
41+
SHA1: {{ release.sha1.gz }}
42+
SHA256: {{ release.sha256.gz }}
43+
SHA512: {{ release.sha512.gz }}
44+
45+
* <{{ release.url.xz }}>
46+
47+
SIZE: {{ release.size.xz }}
48+
SHA1: {{ release.sha1.xz }}
49+
SHA256: {{ release.sha256.xz }}
50+
SHA512: {{ release.sha512.xz }}
51+
52+
* <{{ release.url.zip }}>
53+
54+
SIZE: {{ release.size.zip }}
55+
SHA1: {{ release.sha1.zip }}
56+
SHA256: {{ release.sha256.zip }}
57+
SHA512: {{ release.sha512.zip }}
58+
59+
## Release Comment
60+
61+
Many committers, developers, and users who provided bug reports helped us make this release.
62+
Thanks for their contributions.
63+
64+
The maintenance of Ruby 2.7, including this release, is based on the "Agreement for the Ruby stable version" of the Ruby Association.

‎ko/news/_posts/2022-04-12-ruby-3-0-4-released.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.0.4 Released"
4+
author: "nagachika and mame"
5+
translator:
6+
date: 2022-04-12 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.0.4 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2022-28738: Double free in Regexp compilation]({%link en/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %})
16+
* [CVE-2022-28739: Buffer overrun in String-to-Float conversion]({%link en/news/_posts/2022-04-12-buffer-overrun-in-string-to-float-cve-2022-28739.md %})
17+
18+
See the [commit logs](https://github.com/ruby/ruby/compare/v3_0_3...v3_0_4) for further details.
19+
20+
## Download
21+
22+
{% assign release = site.data.releases | where: "version", "3.0.4" | first %}
23+
24+
* <{{ release.url.gz }}>
25+
26+
SIZE: {{ release.size.gz }}
27+
SHA1: {{ release.sha1.gz }}
28+
SHA256: {{ release.sha256.gz }}
29+
SHA512: {{ release.sha512.gz }}
30+
31+
* <{{ release.url.xz }}>
32+
33+
SIZE: {{ release.size.xz }}
34+
SHA1: {{ release.sha1.xz }}
35+
SHA256: {{ release.sha256.xz }}
36+
SHA512: {{ release.sha512.xz }}
37+
38+
* <{{ release.url.zip }}>
39+
40+
SIZE: {{ release.size.zip }}
41+
SHA1: {{ release.sha1.zip }}
42+
SHA256: {{ release.sha256.zip }}
43+
SHA512: {{ release.sha512.zip }}
44+
45+
## Release Comment
46+
47+
Many committers, developers, and users who provided bug reports helped us make this release.
48+
Thanks for their contributions.

‎ko/news/_posts/2022-04-12-ruby-3-1-2-released.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 3.1.2 Released"
4+
author: "naruse and mame"
5+
translator:
6+
date: 2022-04-12 12:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 3.1.2 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2022-28738: Double free in Regexp compilation]({%link en/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %})
16+
* [CVE-2022-28739: Buffer overrun in String-to-Float conversion]({%link en/news/_posts/2022-04-12-buffer-overrun-in-string-to-float-cve-2022-28739.md %})
17+
18+
See the [commit logs](https://github.com/ruby/ruby/compare/v3_1_1...v3_1_2) for further details.
19+
20+
## Download
21+
22+
{% assign release = site.data.releases | where: "version", "3.1.2" | first %}
23+
24+
* <{{ release.url.gz }}>
25+
26+
SIZE: {{ release.size.gz }}
27+
SHA1: {{ release.sha1.gz }}
28+
SHA256: {{ release.sha256.gz }}
29+
SHA512: {{ release.sha512.gz }}
30+
31+
* <{{ release.url.xz }}>
32+
33+
SIZE: {{ release.size.xz }}
34+
SHA1: {{ release.sha1.xz }}
35+
SHA256: {{ release.sha256.xz }}
36+
SHA512: {{ release.sha512.xz }}
37+
38+
* <{{ release.url.zip }}>
39+
40+
SIZE: {{ release.size.zip }}
41+
SHA1: {{ release.sha1.zip }}
42+
SHA256: {{ release.sha256.zip }}
43+
SHA512: {{ release.sha512.zip }}
44+
45+
## Release Comment
46+
47+
Many committers, developers, and users who provided bug reports helped us make this release.
48+
Thanks for their contributions.

0 commit comments

Comments
 (0)