Ruby Patches Critical Regex Engine Flaws Behind GitLab RCE Bugs

Ruby maintainers have rolled out critical security patches addressing three vulnerabilities in the built-in Onigmo regular expression engine. These flaws were found to enable remote code execution through memory corruption when processing maliciously crafted patterns.

The vulnerabilities directly impacted GitLab, which recently disclosed four critical RCE flaws traced back to the underlying Ruby regex engine. Organizations running affected versions of Ruby or GitLab are strongly advised to upgrade immediately to mitigate potential exploitation.

Regex Engine Vulnerabilities Explained

• The flaws reside in Onigmo, Ruby's default regular expression library.
• Specially crafted regex patterns can trigger memory corruption during compilation.
• This can lead to arbitrary code execution in the context of the Ruby process.
• All three patched bugs affect how the engine handles certain syntax elements.

Impact on GitLab and Recommended Actions

• GitLab identified four critical RCE vulnerabilities linked to these Ruby bugs.
• Exploitation could allow attackers to run commands on backend servers.
• GitLab has released patches across multiple recent versions.
• Administrators should update both Ruby and GitLab to latest secure releases.
• Review systems for signs of compromise if running unpatched versions.

Sources

• Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws