CVE-2010-1330

描述

The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.

如何修補 CVE-2010-1330

要修補 CVE-2010-1330,請將受影響套件升級到下列已修補版本。

• Debian/jruby—升級至 1.5.0~rc1-1 或更新版本
• Maven/org.jruby:jruby-core—升級至 1.4.1 或更新版本

CVE-2010-1330 正在被利用嗎?

低 — EPSS 為 2.2%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 1.5.0~rc1-1
• from 0, < 1.4.1

參考連結(10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2010-1330
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2010-1330
• PATCHgithub.com/jruby/jruby
• WEBrhn.redhat.com/errata/RHSA-2011-1456.html
• WEBsecunia.com/advisories/46891