CVE-2022-28739

Se presenta una lectura excesiva del búfer en Ruby versiones anteriores a 2.6.10, 2.7.x versiones anteriores a 2.7.6, 3.x versiones anteriores a 3.0.4 y 3.1.x versiones anteriores a 3.1.2. Es producida en la conversión String-to-Float, incluyendo Kernel#Float y String#to_f

A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read.

An update that fixes 5 vulnerabilities is now available. This update for ruby2.5 fixes the following issues. Fixed a buffer overrun in String-to-Float conversion. Fixed a regular expression denial of service in Date Parsing Methods. Fixed a StartTLS stripping vulnerability in Net:IMAP. Fixed a trusting FTP PASV responses vulnerability in Net:FTP. Fixed a command injection vulnerability in RDoc.