From 469edd00610328652517e63cd386faee7bd521af Mon Sep 17 00:00:00 2001 From: Shia Date: Tue, 17 Mar 2026 20:36:43 +0900 Subject: [PATCH 1/3] cp {en,ko}/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md Co-Authored-By: Claude Opus 4.6 (1M context) --- ...-05-buffer-overflow-zlib-cve-2026-27820.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md diff --git a/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md b/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md new file mode 100644 index 0000000000..2fdfc0bd94 --- /dev/null +++ b/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md @@ -0,0 +1,36 @@ +--- +layout: news_post +title: "CVE-2026-27820: Buffer overflow vulnerability in Zlib::GzipReader" +author: "hsbt" +translator: +date: 2026-03-05 00:00:00 +0000 +tags: security +lang: en +--- + +A buffer overflow vulnerability exists in `Zlib::GzipReader`. This vulnerability has been assigned the CVE identifier [CVE-2026-27820](https://www.cve.org/CVERecord?id=CVE-2026-27820). We recommend upgrading the zlib gem. + +### Details + +The `zstream_buffer_ungets` function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. + +### Recommended action + +We recommend to update the `zlib` gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: + +* For Ruby 3.2 users: Update to zlib 3.0.1 +* For Ruby 3.3 users: Update to zlib 3.1.2 + +You can use gem update zlib to update it. If you are using bundler, please add `gem "zlib", ">= 3.2.3"` to your Gemfile. + +### Affected versions + +zlib gem 3.2.2 or lower + +### Credits + +Thanks to [calysteon](https://hackerone.com/calysteon) for reporting this issue. Also thanks to [nobu](https://github.com/nobu) for creating the patch. + +## History + +* Originally published at 2026-03-05 09:00:00 (UTC) From c9307c7c4e9567003a6a44191e4b812999c5f576 Mon Sep 17 00:00:00 2001 From: Shia Date: Tue, 17 Mar 2026 20:37:36 +0900 Subject: [PATCH 2/3] Translate "CVE-2026-27820: Buffer overflow vulnerability in Zlib::GzipReader" (ko) Co-Authored-By: Claude Opus 4.6 (1M context) --- ...-05-buffer-overflow-zlib-cve-2026-27820.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md b/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md index 2fdfc0bd94..5ed552708e 100644 --- a/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md +++ b/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md @@ -1,36 +1,36 @@ --- layout: news_post -title: "CVE-2026-27820: Buffer overflow vulnerability in Zlib::GzipReader" +title: "CVE-2026-27820: Zlib::GzipReader의 버퍼 오버플로우 취약점" author: "hsbt" -translator: +translator: "shia" date: 2026-03-05 00:00:00 +0000 tags: security -lang: en +lang: ko --- -A buffer overflow vulnerability exists in `Zlib::GzipReader`. This vulnerability has been assigned the CVE identifier [CVE-2026-27820](https://www.cve.org/CVERecord?id=CVE-2026-27820). We recommend upgrading the zlib gem. +`Zlib::GzipReader`에 버퍼 오버플로우 취약점이 존재합니다. 이 취약점은 CVE 번호 [CVE-2026-27820](https://www.cve.org/CVERecord?id=CVE-2026-27820)으로 등록되었습니다. zlib gem 업그레이드를 권장합니다. -### Details +### 세부 내용 -The `zstream_buffer_ungets` function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. +`zstream_buffer_ungets` 함수는 이전에 생성된 출력 앞에 호출자가 제공한 바이트를 추가하지만, memmove가 기존 데이터를 이동하기 전에 Ruby 문자열이 충분한 용량을 가지고 있는지 보장하지 않습니다. 이로 인해 버퍼 길이가 용량을 초과하면 메모리 손상이 발생할 수 있습니다. -### Recommended action +### 권장 조치 -We recommend to update the `zlib` gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: +`zlib` gem을 버전 3.2.3 이상으로 업데이트하는 것을 권장합니다. 이전 Ruby 시리즈의 번들 버전과의 호환성을 보장하기 위해 다음과 같이 업데이트할 수도 있습니다. -* For Ruby 3.2 users: Update to zlib 3.0.1 -* For Ruby 3.3 users: Update to zlib 3.1.2 +* Ruby 3.2 사용자: zlib 3.0.1로 업데이트 +* Ruby 3.3 사용자: zlib 3.1.2로 업데이트 -You can use gem update zlib to update it. If you are using bundler, please add `gem "zlib", ">= 3.2.3"` to your Gemfile. +gem update zlib 명령으로 업데이트할 수 있습니다. bundler를 사용하는 경우, Gemfile에 `gem "zlib", ">= 3.2.3"`을 추가해 주세요. -### Affected versions +### 해당 버전 -zlib gem 3.2.2 or lower +zlib gem 3.2.2 이하 -### Credits +### 도움을 준 사람 -Thanks to [calysteon](https://hackerone.com/calysteon) for reporting this issue. Also thanks to [nobu](https://github.com/nobu) for creating the patch. +이 문제를 보고해 준 [calysteon](https://hackerone.com/calysteon)에게 감사를 표합니다. 또한 패치를 작성해 준 [nobu](https://github.com/nobu)에게도 감사를 표합니다. -## History +## 수정 이력 -* Originally published at 2026-03-05 09:00:00 (UTC) +* 2026-03-05 09:00:00 (UTC) 최초 공개 From 71a681788589153383f4e1aca0858e148000bd2f Mon Sep 17 00:00:00 2001 From: Shia Date: Wed, 18 Mar 2026 16:50:30 +0900 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: Chayoung You --- .../2026-03-05-buffer-overflow-zlib-cve-2026-27820.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md b/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md index 5ed552708e..4367b24e09 100644 --- a/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md +++ b/ko/news/_posts/2026-03-05-buffer-overflow-zlib-cve-2026-27820.md @@ -1,6 +1,6 @@ --- layout: news_post -title: "CVE-2026-27820: Zlib::GzipReader의 버퍼 오버플로우 취약점" +title: "CVE-2026-27820: Zlib::GzipReader의 버퍼 오버플로 취약점" author: "hsbt" translator: "shia" date: 2026-03-05 00:00:00 +0000 @@ -8,7 +8,7 @@ tags: security lang: ko --- -`Zlib::GzipReader`에 버퍼 오버플로우 취약점이 존재합니다. 이 취약점은 CVE 번호 [CVE-2026-27820](https://www.cve.org/CVERecord?id=CVE-2026-27820)으로 등록되었습니다. zlib gem 업그레이드를 권장합니다. +`Zlib::GzipReader`에 버퍼 오버플로 취약점이 존재합니다. 이 취약점은 CVE 번호 [CVE-2026-27820](https://www.cve.org/CVERecord?id=CVE-2026-27820)으로 등록되었습니다. zlib gem 업그레이드를 권장합니다. ### 세부 내용 @@ -16,7 +16,7 @@ lang: ko ### 권장 조치 -`zlib` gem을 버전 3.2.3 이상으로 업데이트하는 것을 권장합니다. 이전 Ruby 시리즈의 번들 버전과의 호환성을 보장하기 위해 다음과 같이 업데이트할 수도 있습니다. +`zlib` gem을 버전 3.2.3 이상으로 업데이트하는 것을 권장합니다. 이전 Ruby 버전대에 내장된 버전과의 호환성을 보장하기 위해 다음과 같이 업데이트할 수도 있습니다. * Ruby 3.2 사용자: zlib 3.0.1로 업데이트 * Ruby 3.3 사용자: zlib 3.1.2로 업데이트