An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through…
Priority MEDIUM 54CWE-502Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01571 75th percentileScored 2026-11-07
Fix Partial rdoc (RubyGems): 6.3.4.1, 6.4.1.1, 6.5.1.1 +1Red Hat: 7 advisoriesRed Hat: 3 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rdoc (RubyGems) | 6.3.3 to before 6.3.4.1 | 6.3.4.1 | Patch available | GHSA-592j-995h-p23j |
| — | rdoc (RubyGems) | 6.4.0 to before 6.4.1.1 | 6.4.1.1 | Patch available | GHSA-592j-995h-p23j |
| — | rdoc (RubyGems) | 6.5.0 to before 6.5.1.1 | 6.5.1.1 | Patch available | GHSA-592j-995h-p23j |
| — | rdoc (RubyGems) | 6.6.0 to before 6.6.3.1 | 6.6.3.1 | Patch available | GHSA-592j-995h-p23j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rdoc (RubyGems) Vendor— Affected 6.3.3 to before 6.3.4.1 Fixed in 6.3.4.1 Patch available GHSA-592j-995h-p23j
- rdoc (RubyGems) Vendor— Affected 6.4.0 to before 6.4.1.1 Fixed in 6.4.1.1 Patch available GHSA-592j-995h-p23j
- rdoc (RubyGems) Vendor— Affected 6.5.0 to before 6.5.1.1 Fixed in 6.5.1.1 Patch available GHSA-592j-995h-p23j
- rdoc (RubyGems) Vendor— Affected 6.6.0 to before 6.6.3.1 Fixed in 6.6.3.1 Patch available GHSA-592j-995h-p23j
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby:rdoc:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:ruby:rdoc:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · GHSA-592j-995h-p23j rdoc (RubyGems) Fixed in 6.3.4.1 Advisory →
- Fix · GHSA-592j-995h-p23j rdoc (RubyGems) Fixed in 6.4.1.1 Advisory →
- Fix · GHSA-592j-995h-p23j rdoc (RubyGems) Fixed in 6.5.1.1 Advisory →
- Fix · GHSA-592j-995h-p23j rdoc (RubyGems) Fixed in 6.6.3.1 Advisory →
Red Hat 7 advisories
- RHSA-2024:4499 Released 2024-07-11 · Red Hat rating Moderateruby security update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-112.module+el8.10.0+22021+135c76a8.aarch64::ruby:2.5, ruby-2.5.9-112.module+el8.10.0+22021+135c76a8.i686::ruby:2.5, ruby-2.5.9-112.module+el8.10.0+22021+135c76a8.ppc64le::ruby:2.5 +47
- RHSA-2024:3838 Released 2024-06-11 · Red Hat rating Moderateruby security update
- Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-162.el9_4, ruby-default-gems-3.0.7-162.el9_4, ruby-devel-3.0.7-162.el9_4 +18
- Red Hat Enterprise Linux CRB (v. 9) ruby-doc-3.0.7-162.el9_4
- RHSA-2024:3671 Released 2024-06-06 · Red Hat rating Moderateruby:3.3 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.1-2.module+el9.4.0+21859+16f07581.aarch64::ruby:3.3, ruby-3.3.1-2.module+el9.4.0+21859+16f07581.i686::ruby:3.3, ruby-3.3.1-2.module+el9.4.0+21859+16f07581.ppc64le::ruby:3.3 +47
Show 4 more Red Hat advisories
- RHSA-2024:3670 Released 2024-06-06 · Red Hat rating Moderateruby:3.3 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.1-2.module+el8.10.0+21860+47fbda2a.aarch64::ruby:3.3, ruby-3.3.1-2.module+el8.10.0+21860+47fbda2a.i686::ruby:3.3, ruby-3.3.1-2.module+el8.10.0+21860+47fbda2a.ppc64le::ruby:3.3 +47
- RHSA-2024:3668 Released 2024-06-06 · Red Hat rating Moderateruby:3.1 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) ruby-3.1.5-144.module+el9.4.0+21780+79b7bdb5.aarch64::ruby:3.1, ruby-3.1.5-144.module+el9.4.0+21780+79b7bdb5.i686::ruby:3.1, ruby-3.1.5-144.module+el9.4.0+21780+79b7bdb5.ppc64le::ruby:3.1 +47
- RHSA-2024:3546 Released 2024-06-03 · Red Hat rating Moderateruby:3.1 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.aarch64::ruby:3.1, ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.i686::ruby:3.1, ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.ppc64le::ruby:3.1 +47
- RHSA-2024:3500 Released 2024-05-30 · Red Hat rating Moderateruby:3.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64::ruby:3.0, ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.i686::ruby:3.0, ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le::ruby:3.0 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Out of support scope |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3500, RHSA-2024:3546, RHSA-2024:3670, RHSA-2024:4499 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:3668, RHSA-2024:3671, RHSA-2024:3838 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:3838 |
Not affected: 4 products
- Red Hat Enterprise Linux 10
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27281
- 2026-10-03 Alias added: GHSA-592j-995h-p23j
References
Other 16
- https://hackerone.com/reports/1187477
- https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/
- https://github.com/ruby/rdoc/commit/1254b0066f312ddbf7fae7a195e66ce5b3bc6656
- https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644
- https://github.com/ruby/rdoc/commit/48617985e9fbc2825219d55f04e3e0e98d2923be
- https://github.com/ruby/rdoc/commit/811f125a4a0cc968e3eb18e16ea6c1a3b49a11bf
- https://github.com/ruby/rdoc/commit/a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e
- https://github.com/ruby/rdoc/commit/d22ba930f1f611dda531dba04cd3d2531bb3f8a5
- https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d
- https://github.com/ruby/rdoc/commit/e4a0e71e6f1032f8b4e5e58b4ef60d702c22ce17
- https://github.com/ruby/rdoc
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2024-27281.yml
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N
- https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281
Sources
- CVE-2024-27281 · CVE Program
- CVE-2024-27281 · NVD
- FIRST EPSS
- GHSA-592j-995h-p23j · GitHub Advisory Database · CC BY 4.0
- CVE-2024-27281 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences