CVE-2014-2734
- State
- Published
- Severity
- Not scored
- Published
- Apr 24, 2014
- Updated
- Aug 6, 2024
- Reserved
- Apr 8, 2014
Description
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html
- 106006vdb-entry
- https://news.ycombinator.com/item?id=7601973
- 66956vdb-entry
- 20140502 Re: Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoCmailing-list
- https://gist.github.com/10446549
- https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/
- https://gist.github.com/emboss/91696b56cd227c8a0c13
- https://github.com/adrienthebo/cve-2014-2734/
- 20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoCmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.