logo

Database

SQL injection In ffi

Description

Ruby-ffi has a DLL loading issue ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2018-10002012. NVD-2018-10002013. OSV-2018-10002014. GCVE-2018-1000201

References

1. https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a2. https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c3. https://github.com/ffi/ffi/releases/tag/1.9.244. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ffi/CVE-2018-1000201.yml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.