CVE-2014-2734
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher
** DISPUTADA ** La extensión openssl en Ruby 2.x no mantiene correctamente el estado de la memoria de procesos después de la reapertura de un fichero, lo que permite a atacantes remotos falsificar firmas dentro del contexto de una secuencia de comandos Ruby que intenta la verificación de firmas después de realizar cierta secuencia de operaciones del sistema de ficheros. NOTA: este problema ha sido disputado por el equipo OpenSSL de Ruby y terceras partes, que dicen que la demostración PoC original contiene errores y código redundante o innecesariamente complejo que no parece estar relacionado con una demostración del problema. Desde 02052014, CVE no está consciente de ningún comentario público por parte del investigador original.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-04-08 CVE Reserved
- 2014-04-20 First Exploit
- 2014-04-24 CVE Published
- 2024-04-22 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-399: Resource Management Errors
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2014/May/13 | Mailing List |
|
| http://www.osvdb.org/106006 | Vdb Entry | |
| http://www.securityfocus.com/bid/66956 | Vdb Entry | |
| https://gist.github.com/10446549 | X_refsource_misc | |
| https://gist.github.com/emboss/91696b56cd227c8a0c13 | X_refsource_misc | |
| https://github.com/adrienthebo/cve-2014-2734 | X_refsource_misc | |
| https://news.ycombinator.com/item?id=7601973 | X_refsource_misc | |
| https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734 | X_refsource_misc |
| URL | Date | SRC |
|---|---|---|
| https://github.com/gdisneyleugers/CVE-2014-2734 | 2014-04-20 | |
| http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html | 2024-08-06 | |
| http://seclists.org/fulldisclosure/2014/Apr/231 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | p0 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | p195 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | p247 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | preview1 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | preview2 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | rc1 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.0.0 Search vendor "Ruby-lang" for product "Ruby" and version "2.0.0" | rc2 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.1 Search vendor "Ruby-lang" for product "Ruby" and version "2.1" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.1 Search vendor "Ruby-lang" for product "Ruby" and version "2.1" | preview1 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 2.1.1 Search vendor "Ruby-lang" for product "Ruby" and version "2.1.1" | - |
Affected
| ||||||