Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2020-10933 - Vulnerability Database
Ruby

Ruby Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2020-10933

Medium
Reference: CVE-2020-10933
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-10933
Title: Ruby Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Overview:

An issue was discovered in Ruby 2.5.x through 2.5.7 2.6.x through 2.6.5 and 2.7.0. If a victim calls BasicSocketread_nonblock(requested_size buffer exception: false) the method resizes the buffer to fit the requested size but no data is copied. Thus the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.