Security

Please report security vulnerabilities via the process outlined in the reporting vulnerabilities guide. Specific guidelines for reporting security issues of the GraalVM project, including TruffleRuby, can be found in the SECURITY file.

MRI Vulnerabilities #

Vulnerabilities reported against MRI may apply to the design of Ruby or to code that we share with MRI. We list reported MRI vulnerabilities here and document how MRI has mitigated the vulnerability, if the mitigation is tested by anything, and how TruffleRuby has mitigated. We have not investigated all legacy vulnerabilities, as it is often very hard to work out the details from older reports.

Cross-reference with the details on the MRI website.

Number	Description	Their Mitigation	Test	Our Mitigation
CVE-2024-39908	DoS in REXML	Fix	Test	same mitigation as CRuby, users must update rexml to 3.3.2+ if they use it
CVE-2024-35176	DoS in REXML	Fix	Test	same mitigation as CRuby, users must update rexml to 3.2.7+ if they use it
CVE-2024-27282	Arbitrary memory address read vulnerability with Regex search	Fix		Not applicable thanks to Java semantics
CVE-2024-27281	RCE vulnerability with .rdoc_options in RDoc	Fix		Not applicable because TruffleRuby does not generate rdoc on gem install
CVE-2024-27280	Buffer overread vulnerability in StringIO	Fix	Test	Not applicable, we use the Ruby implementation of StringIO
CVE-2023-36617	ReDoS vulnerability in URI	Fix	Test	Not applicable thanks to TRegex
CVE-2023-28756	ReDoS vulnerability in Time	Fix	Test	Not applicable thanks to TRegex
CVE-2023-28755	ReDoS vulnerability in URI	Fix	Test	Not applicable thanks to TRegex
CVE-2021-33621	HTTP response splitting in CGI	Fix	Test	Same
CVE-2022-28739	Buffer overrun in String-to-Float conversion			Not applicable thanks to Java semantics
CVE-2022-28738	Double free in Regexp compilation			Not applicable thanks to Java semantics
CVE-2021-41819	Cookie Prefix Spoofing in CGI::Cookie.parse	Fix	Test	Same
CVE-2021-41817	Regular expression denial of service vulnerability (ReDoS) in date	Fix	Test	Not applicable thanks to TRegex
CVE-2021-41816	Buffer Overrun in CGI.escape_html	Fix	Test	Not applicable, we use the Ruby definition of CGI.escape_html
CVE-2021-31810	Trusting FTP PASV responses vulnerability in Net::FTP	Fix	Test	Same
CVE-2021-32066	A StartTLS stripping vulnerability in Net::IMAP	Fix	Test	Same
CVE-2021-31799	A command injection vulnerability in RDoc	Fix Backport	Test	Same
CVE-2021-28966	Path traversal in Tempfile on Windows	Sanitization of paths in tmpdir.rb	In `test/mri/tests/test_tmpdir.rb`	Sanitization of paths in tmpdir.rb
CVE-2020-25613	Potential HTTP Request Smuggling Vulnerability in WEBrick	Fix		WEBrick no longer shipped in stdlib
CVE-2020-10933	Heap exposure vulnerability in the socket library	Fix		Not applicable thanks to Java semantics
CVE-2021-28965	XML round-trip vulnerability in REXML	Update to REXML 3.2.5	In ruby/rexml	Update to REXML 3.2.5
CVE-2020-10663	Unsafe Object Creation Vulnerability in JSON (Additional fix)	Fix	Spec	The pure Ruby version of JSON we use is safe
CVE-2019-16255	A code injection vulnerability of Shell#[] and Shell#test	Fix	MRI test	Same
CVE-2019-16254	HTTP response splitting in WEBrick (Additional fix)	Fix	MRI test	Same
CVE-2019-15845	A NUL injection vulnerability of File.fnmatch and File.fnmatch?	Fix	MRI test	Check for NUL bytes
CVE-2019-16201	Regular Expression Denial of Service vulnerability of WEBrick’s Digest access authentication	Fix	MRI test	Same
CVE-2012-6708	Multiple jQuery vulnerabilities in RDoc	Remove jquery.js	N/A	Same
CVE-2015-9251	Multiple jQuery vulnerabilities in RDoc	Remove jquery.js	N/A	Same
CVE-2019-8320	Delete directory using symlink when decompressing `tar`	Check the expanded path	Tested in MRI `test/rubygems/test_gem_package.rb`	Applied the same patch
CVE-2019-8321	Escape sequence injection in `verbose`	Sanitise message	Tested in `ruby/spec` `:security`	Applied the same patch
CVE-2019-8322	Escape sequence injection in `gem owner`	Sanitise message	Tested in `ruby/spec` `:security`	Applied the same patch
CVE-2019-8323	Escape sequence injection vulnerability in API response handling	Sanitise message	Tested in `ruby/spec` `:security`	Applied the same patch
CVE-2019-8324	Installing a malicious gem may lead to arbitrary code execution	Verifying gems before pre-install checks	Tested in MRI `test/rubygems/test_gem_installer.rb`	Applied the same patch
CVE-2019-8325	Escape sequence injection in errors	Sanitise error messages	Tested in `ruby/spec` `:security`	Applied the same patch
None	Multiple vulnerabilities in RubyGems			Applied the same patch
CVE-2018-16395	`OpenSSL::X509::Name` equality check does not work correctly
CVE-2018-16396	Tainted flags are not propagated in `Array#pack` and `String#unpack` with some directives	Additional taint operations	Tested in `ruby/spec` `:security`	Additional taint operations
CVE-2018-6914	Unintentional file and directory creation with directory traversal in `tempfile` and `tmpdir`	Sanitization of paths	Tested in `ruby/spec` `:security`	Sanitization of paths
CVE-2018-8779	Unintentional socket creation by poisoned NUL byte in `UNIXServer` and `UNIXSocket`	Check for NUL bytes	Tested in `ruby/spec` `:security`	Check for NUL bytes
CVE-2018-8780	Unintentional directory traversal by poisoned NUL byte in `Dir`	Check for NUL bytes	Tested in `ruby/spec` `:security`	Check for NUL bytes
CVE-2018-8777	DoS by large request in WEBrick	Logic for header length	Tested in MRI `test/webrick/test_httpserver.rb`	Applied the same mitigation
CVE-2017-17742	HTTP response splitting in WEBrick	Logic for invalid headers	Tested in `ruby/spec` `:security`	Applied the same mitigation
CVE-2018-8778	Buffer under-read in String#unpack	A range check	Tested in `ruby/spec` `:security`	A range check
CVE-2017-17405	Command injection vulnerability in `Net::FTP`	Treat paths in commands explicitly as paths, not general IO commands	Tested in MRI `test/net/ftp/test_ftp.rb`	Applied the same mitigation
CVE-2017-10784	Escape sequence injection vulnerability in the Basic authentication of WEBrick	Proper escaping of logs	Tested in MRI `test/webrick/test_httpauth.rb`	Applied the same mitigation
CVE-2017-0898	Buffer underrun vulnerability in `Kernel.sprintf`
CVE-2017-14033	Buffer underrun vulnerability in OpenSSL ASN1 decode
CVE-2017-14064	Heap exposure vulnerability in generating JSON
CVE-2017-0902, CVE-2017-0899, CVE-2017-0900, CVE-2017-0901	Multiple vulnerabilities in RubyGems
CVE-2015-7551	Unsafe tainted string usage in Fiddle and DL (regression of the mitigation of CVE-2009-5147)	Additional taint checks	Tested in MRI `test/mri/tests/fiddle/test_handle.rb`	Not applicable as we do not support `$SAFE`, and the `DL` module was removed in Ruby 2.2.0
CVE-2015-1855	Ruby OpenSSL Hostname Verification
CVE-2014-8090	Another Denial of Service XML Expansion
CVE-2014-8080	Denial of Service XML Expansion		Tested in `ruby/spec` `:security`
None	Changed default settings of ext/openssl
CVE-2014-2734	Dispute of Vulnerability
CVE-2014-0160	OpenSSL Severe Vulnerability in TLS Heartbeat Extension
CVE-2014-2525	Heap Overflow in YAML URI Escape Parsing
CVE-2013-4164	Heap Overflow in Floating Point Parsing		Tested in `ruby/spec` `:security`
CVE-2013-4073	Hostname check bypassing vulnerability in SSL client
CVE-2013-2065	Object taint bypassing in DL and Fiddle in Ruby	Additional taint checks	Tested in MRI `test/mri/tests/fiddle/test_func.rb`	Not applicable as we do not support `$SAFE`, and the `DL` module was removed in Ruby 2.2.0
CVE-2013-1821	Entity expansion DoS vulnerability in REXML
CVE-2013-0269	Denial of Service and Unsafe Object Creation Vulnerability in JSON
CVE-2013-0256	XSS exploit of RDoc documentation generated by `rdoc`
CVE-2012-5371	Hash-flooding DoS vulnerability for ruby 1.9
CVE-2012-4522	Unintentional file creation caused by inserting a illegal NUL character
CVE-2012-4464, CVE-2012-4466	$SAFE escaping vulnerability about `Exception#to_s` / `NameError#to_s`			Not applicable as we do not support `$SAFE`
None	Security Fix for RubyGems: SSL server verification failure for remote repository
CVE-2011-3389	Security Fix for Ruby OpenSSL module: Allow 0/n splitting as a prevention for the TLS BEAST attack
CVE-2011-4815	Denial of service attack was found for Ruby’s Hash algorithm (cross-reference CVE-2011-4838, CVE-2012-5370, CVE-2012-5372)	Hashes are made non-deterministic by incorporating process start time	Tested in `ruby/spec` `:security`	Hashes are made non-deterministic by incorporating a seed from `/dev/urandom`
None	Exception methods can bypass `$SAFE`			Not applicable as we do not support `$SAFE`
None	FileUtils is vulnerable to symlink race attacks
CVE-2010-0541	XSS in WEBrick			WEBrick no longer shipped
None	Buffer over-run in `ARGF.inplace_mode=`
None	WEBrick has an Escape Sequence Injection vulnerability			WEBrick no longer shipped
CVE-2009-5147	`DL::dlopen` opens libraries with tainted names	Additional taint checks	The `DL` module does not exist in modern Ruby	Not applicable as we do not support `$SAFE`, and the `DL` module was removed in Ruby 2.2.0
CVE-2009-4124	Heap overflow in `String`
None	DoS vulnerability in `BigDecimal`
None	DoS vulnerability in `REXML`
CVE-2008-1447	Multiple vulnerabilities in Ruby
CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726, CVE-2008-2664, CVE-2008-1891	Arbitrary code execution vulnerabilities
None	File access vulnerability of WEBrick			WEBrick no longer shipped
None	`Net::HTTPS` Vulnerability
JVN#84798830	Another DoS Vulnerability in CGI Library
CVE-2006-5467	DoS Vulnerability in CGI Library
VU#160012	Ruby vulnerability in the safe level settings			Not applicable as we do not support `$SAFE`

JRuby Vulnerabilities #

TruffleRuby uses code from JRuby, so vulnerabilities reported against JRuby may apply to TruffleRuby.

Number	Description	Their Mitigation	Test	Our Mitigation
CVE-2012-5370	JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably (cross-reference CVE-2011-4815, CVE-2011-4838, CVE-2012-5372)	Hashes are made non-deterministic by incorporating process start time	Tested in `ruby/spec` `:security`	Hashes are made non-deterministic by incorporating a seed from `/dev/urandom`
CVE-2011-4838	JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably (cross-reference CVE-2011-4815, CVE-2012-5370, CVE-2012-5372)	Hashes are made non-deterministic by incorporating process start time	Tested in `ruby/spec` `:security`	Hashes are made non-deterministic by incorporating a seed from `/dev/urandom`

Rubinius Vulnerabilities #

TruffleRuby uses code from Rubinius, so vulnerabilities reported against Rubinius may apply to TruffleRuby.

Number	Description	Their Mitigation	Test	Our Mitigation
CVE-2012-5372	Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably (cross-reference CVE-2011-4815, CVE-2011-4838, CVE-2012-5370)	Hashes are made non-deterministic by incorporating output from `/dev/urandom`	Tested in `ruby/spec` `:security`	Hashes are made non-deterministic by incorporating a seed from `/dev/urandom`

Java Dependency Vulnerabilities #

JONI #

No vulnerabilities are known.

JCodings #

Number	Description	Their Mitigation	Test	Our Mitigation
CVE-2010-1330	The regular expression engine in JRuby before 1.4.1, when `$KCODE` is set to `'u'`, does not properly handle characters immediately after a UTF-8 character	Check byte sequences for the UTF-8 encoding when perform regexp operations	Tested in `ruby/spec` `:security`	Applied the same mitigation

Other Dependency Vulnerabilities #

`zlib` #

No vulnerabilities are known, but consider potential vulnerabilities in your system zlib.

`libssl` #

Consider potential vulnerabilities in your system libssl.

FFI #

Number	Description	Their Mitigation	Test	Our Mitigation
CVE-2018-1000201	A DLL loading issue can be hijacked on Windows when a `Symbol` is used for the library name	Treat Symbols the same as Strings in `ffi_lib`		Applied the same mitigation, by using a version of FFI which fixed this vulnerability

Notes on Hashing #

TruffleRuby uses MurmurHash2 hashing with a seed from /dev/urandom - it cannot be configured to use any other hashing algorithm. For hashing strings, TruffleRuby uses Java’s hash algorithm (and then MurmurHash2 on top).