CVE-2017-14033 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openssl

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer13 documents8 sources
Severity
7.5HIGHNVD
OSV8.8
EPSS
7.8%
top 8.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ruby-lang RubyOpenssl
Timeline
PublishedSep 19
Latest updateMay 14

Description

The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶RubyGemsopenssl/openssl< 2.0.0
▶Alpineruby-lang/ruby< 2.4.2-r0+20
▶NVDruby-lang/ruby15 versions+14

Patches

Patch: www.ruby-lang.org ↗Patch: www.ruby-lang.org ↗Patch: www.ruby-lang.org ↗

🔴Vulnerability Details

5
OSV
Ruby OpenSSL DoS Vulnerability↗2022-05-14
▶
GHSA
Ruby OpenSSL DoS Vulnerability↗2022-05-14
▶
OSV
ruby1.9.1, ruby2.3 vulnerabilities↗2018-01-10
▶
CVEList
CVE-2017-14033: The decode method in the OpenSSL::ASN1 module in Ruby before 2↗2017-09-19
▶
OSV
CVE-2017-14033: The decode method in the OpenSSL::ASN1 module in Ruby before 2↗2017-09-19
▶

📋Vendor Advisories

5
Apple
CVE-2017-14033: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra↗2018-10-30
▶
Apple
CVE-2017-14033: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan↗2018-07-09
▶
Ubuntu
Ruby vulnerabilities↗2018-01-10
▶
Ubuntu
Ruby vulnerabilities↗2017-10-05
▶
Red Hat
ruby: Buffer underrun in OpenSSL ASN1 decode↗2017-09-14
▶

💬Community

2
Bugzilla
CVE-2017-0898 CVE-2017-10784 CVE-2017-14033 ruby: various flaws [fedora-all]↗2017-09-15
▶
Bugzilla
CVE-2017-14033 ruby: Buffer underrun in OpenSSL ASN1 decode↗2017-09-14
▶
CVE-2017-14033 — Openssl vulnerability | cvebase