New mruby advisory - new release data

rubies/mruby/CVE-2022-4996.yml

@@ -0,0 +1,36 @@
+---
+engine: mruby
+cve: 2022-4996
+ghsa: rm4w-cfgf-329j
+url: https://nvd.nist.gov/vuln/detail/CVE-2022-4996
+title: bigint.c udiv floating point comparison with incorrect operator
+date: 2026-08-20
+description: |
+  A flaw has been found in mruby 3.1.0. Affected is the function udiv
+  of the file bigint.c. Executing a manipulation can lead to floating
+  point comparison with incorrect operator. It is possible to launch
+  the attack remotely. The exploit has been published and may be
+  used. It is best practice to apply a patch to resolve this issue.
+cvss_v2: 5.0
+cvss_v3: 5.3
+cvss_v4: 5.5
+patched_versions:
+  - ">= 3.2.0-rc"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-4996
+    - https://github.com/mruby/mruby/compare/3.1.0...3.2.0-rc
+    - https://github.com/mruby/mruby/commit/ef1974099deeb3df3f41026e02d6ac93cd4684ee
+    - https://huntr.com/bounties/5a5092df-1699-4497-a8b2-38318bce0c4e
+    - https://vuldb.com/cve/CVE-2022-4996
+    - https://vuldb.com/submit/877513
+    - https://vuldb.com/vuln/391391
+    - https://vuldb.com/vuln/391391/cti
+    - https://github.com/advisories/GHSA-rm4w-cfgf-329j
+notes: |
+  - cvss_v[345] and date from nvd.nist.gov URL.
+  - Found commit ef19740 (8/25/2022) after logging into huntr URL.
+    -- TITLE: (bigint.c (mrb_bint_powm): check zero division first.)
+  - Found commit ef19740 (8/25/2022) in /compare/ URL.
+  - This CVE was not listed on this page
+    https://mruby.org/releases/2023/02/24/mruby-3.2.0-released.html