CVE-2014-2734: ruby-lang ruby Resource Management Errors

Vulnerability summary

CVE-2014-2734 is a medium (CVSS 5.8) Resource Management Errors vulnerability in ruby-lang ruby. EPSS estimates a 5.35% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-04-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher

• CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.