GitHub Advisoryadvisory · RubyGems

GHSA-wwh7-4jw9-33x6 yajl-ruby gem Denial of Service vulnerability

HIGH Published 2017-11-28 Modified 2023-08-29 Official page ↗
Aliases
CVE-2017-16516
Ecosystem
RubyGems
Packages
yajl-ruby
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-134
Reviewed
2020-06-16

Affected packages

• RubyGems yajl-ruby: < 1.3.1 → fixed in 1.3.1

Description

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to `Yajl::Parser.new.parse`, the whole ruby process crashes with a SIGABRT in the `yajl_string_decode` function in `yajl_encode.c`. This results in the whole ruby process terminating and potentially a denial of service.

Related

Alias · CVE (1)

  • CVE-2017-16516 In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a… vulnerability

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References