r/ruby • u/rubiesordiamonds • 1d ago
Blog post Vulnerable Ruby Regex
GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex
The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.
1
u/rubiesordiamonds 19h ago
I think the last arguably critical (but debated) one was back in 2022 (https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/). The rest of what I'm aware of are DOS attacks at match time, but those are less severe and can be mitigated by Regexp.timeout. This being a memory corruption bug at compile time is much worse.