CVE-2014-2734
published 2014-04-24CVE-2014-2734: The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof…
PriorityP431medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
5.35%
91.6th percentile
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ruby-lang | ruby | — | — |
| ruby-lang | ruby | — | — |
| ruby-lang | ruby | — | — |
| ruby-lang | ruby | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Ruby 2.0/2.0.0/2.1.1 Filesystem resource management (News 126218 / BID-66956)
vuldb·2026-05-12·CVSS 5.8
CVE-2014-2734 [MEDIUM] Ruby 2.0/2.0.0/2.1.1 Filesystem resource management (News 126218 / BID-66956)
A vulnerability was found in Ruby 2.0/2.0.0/2.1.1. It has been declared as critical. This impacts an unknown function of the component Filesystem. The manipulation results in improper resource management.
This vulnerability is cataloged as CVE-2014-2734. The attack may be launched remotely. Furthermore, there is an exploit available.
The real existence of this vulnerability is still doubted at the moment.
GHSA
GHSA-6qq6-x75v-fgg7: ** DISPUTED ** The openssl extension in Ruby 2
ghsa_unreviewed·2022-05-17
CVE-2014-2734 [MEDIUM] GHSA-6qq6-x75v-fgg7: ** DISPUTED ** The openssl extension in Ruby 2
** DISPUTED ** The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher.
Red Hat
ruby: SSL signature spoofing flaw
vendor_redhat·2014-04-10·CVSS 5.8
CVE-2014-2734 [MEDIUM] ruby: SSL signature spoofing flaw
ruby: SSL signature spoofing flaw
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher
Package: ruby193-ruby (OpenShift Enterprise 1) - Not affected
Package: ruby (Red Hat Enterprise Linux 5) - Not affected
Package
No detection rules found.
No public exploits indexed.
http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.htmlhttp://seclists.org/fulldisclosure/2014/Apr/231http://seclists.org/fulldisclosure/2014/May/13http://www.osvdb.org/106006http://www.securityfocus.com/bid/66956https://gist.github.com/10446549https://gist.github.com/emboss/91696b56cd227c8a0c13https://github.com/adrienthebo/cve-2014-2734/https://news.ycombinator.com/item?id=7601973https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.htmlhttp://seclists.org/fulldisclosure/2014/Apr/231http://seclists.org/fulldisclosure/2014/May/13http://www.osvdb.org/106006http://www.securityfocus.com/bid/66956https://gist.github.com/10446549https://gist.github.com/emboss/91696b56cd227c8a0c13https://github.com/adrienthebo/cve-2014-2734/https://news.ycombinator.com/item?id=7601973https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/
2014-04-24
Published