Ruby, GitLab and the Onigmo Flaw: What You Need to Know Now
Ruby shipped emergency patches this week after three bugs in Onigmo, the language’s regular expression engine, were found to underlie four critical GitLab remote code execution (RCE) vulnerabilities. The issues let specially crafted patterns corrupt memory during regex compilation, and because GitLab compiles user-supplied patterns in some features, the result was severe: multiple high-severity CVEs, including unauthenticated 10.0-rated flaws. This post explains what happened, who’s at risk, and the practical…