Updated advisory posts against rubysec/ruby-advisory-db@040177d

Author: postmodern

advisories/_posts/2024-03-21-CVE-2024-27280.md

@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2024-27280 (stringio): Buffer overread vulnerability in StringIO'
+comments: false
+categories:
+- stringio
+advisory:
+  gem: stringio
+  cve: 2024-27280
+  url: https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/
+  title: Buffer overread vulnerability in StringIO
+  date: 2024-03-21
+  description: |
+    An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x
+    through 3.0.6 and 3.1.x through 3.1.4.
+
+    The `ungetbyte` and `ungetc` methods on a StringIO can read past the end of a
+    string, and a subsequent call to `StringIO.gets` may return the memory value.
+
+    This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x
+    and later.
+
+    We recommend to update the StringIO gem to version 3.0.3 or later. In order to
+    ensure compatibility with bundled version in older Ruby series, you may update
+    as follows instead:
+
+    * For Ruby 3.0 users: Update to `stringio` 3.0.1.1
+    * For Ruby 3.1 users: Update to `stringio` 3.0.1.2
+
+    You can use `gem update stringio` to update it. If you are using bundler,
+    please add `gem "stringio", ">= 3.0.1.2"` to your `Gemfile`.
+  patched_versions:
+  - "~> 3.0.1.1"
+  - ">= 3.0.1.2"
+---