CVEs-PoC/2017/CVE-2017-0898.md

### [CVE-2017-0898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898)
![](https://img.shields.io/static/v1?label=Product&message=Ruby&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Versions%20before%202.4.2%2C%202.3.5%2C%20and%202.2.8%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Format%20String%20Vulnerability%20(CWE-134)&color=brightgreen)

### Description

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

### POC

#### Reference
- https://hackerone.com/reports/212241

#### Github
No PoCs found on GitHub currently.