Ruby Addresses Three Onigmo Regex Engine Vulnerabilities Linked to GitLab RCE Flaws

Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to address three critical vulnerabilities in the Onigmo regex engine, which were exploited to enable remote code execution (RCE) in GitLab. The flaws allowed memory corruption via malicious regex patterns, prompting urgent patches to mitigate potential server compromises.

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.

GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.

Ruby says any

Read original article