CVE

Id
70029  
CVE No.
CVE-2014-2734  
Status
Candidate  
Description
** DISPUTED ** The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher.  
Phase
Assigned (20140408)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
668209 70029 CVE-2014-2734 FULLDISC:20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC  View
668210 70029 CVE-2014-2734 URL:http://seclists.org/fulldisclosure/2014/Apr/231  View
668211 70029 CVE-2014-2734 FULLDISC:20140502 Re: Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC  View
668212 70029 CVE-2014-2734 URL:http://seclists.org/fulldisclosure/2014/May/13  View
668213 70029 CVE-2014-2734 MISC:http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html  View
668214 70029 CVE-2014-2734 MISC:https://gist.github.com/10446549  View
668215 70029 CVE-2014-2734 MISC:https://gist.github.com/emboss/91696b56cd227c8a0c13  View
668216 70029 CVE-2014-2734 MISC:https://github.com/adrienthebo/cve-2014-2734/  View
668217 70029 CVE-2014-2734 MISC:https://news.ycombinator.com/item?id=7601973  View
668218 70029 CVE-2014-2734 MISC:https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/  View
668219 70029 CVE-2014-2734 BID:66956  View
668220 70029 CVE-2014-2734 URL:http://www.securityfocus.com/bid/66956  View
668221 70029 CVE-2014-2734 OSVDB:106006  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
13117 JVNDB-2014-001992 Isode M-Link におけるサービス運用妨害 (DoS) の脆弱性 Isode M-Link は、圧縮された XML 要素の処理を適切に制限しないため、サービス運用妨害 (リソース消費) 状態にされる脆弱性が存在します。 CVE-2014-2742 70029 7.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001992.html  View