CVE-2010-1330: XSS in the regular expression engine when processing invalid UTF-8 byte sequences

November 23, 2012 (updated August 16, 2017)

The regular expression engine in this package, when $KCODE is set to ‘u’, does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.

References

www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html
bugs.gentoo.org/show_bug.cgi?id=317435

Code Behaviors & Features

Detect and mitigate CVE-2010-1330 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →