CVE-2022-28738

CVE-2022-28738

Name

CVE-2022-28738

Description

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.

NVD Severity

unknown

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://security-tracker.debian.org/tracker/CVE-2022-28738
CONFIRM	https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/
MISC	https://hackerone.com/reports/1220911
CONFIRM	https://security.netapp.com/advisory/ntap-20220624-0002/
cve@mitre.org	https://security.gentoo.org/glsa/202401-27

Type

URI

MISC

https://security-tracker.debian.org/tracker/CVE-2022-28738

CONFIRM

https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/

MISC

https://hackerone.com/reports/1220911

CONFIRM

https://security.netapp.com/advisory/ntap-20220624-0002/

cve@mitre.org

https://security.gentoo.org/glsa/202401-27