PT-2017-2894
CVE-2017-14064
·
تاريخ النشر
2017-08-31
·
تاريخ التحديث
2026-09-18
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Ruby versions prior to 2.2.8
Ruby versions 2.3.x through 2.3.4
Ruby versions 2.4.x through 2.4.1
Description
The issue lies in the use of
strdup in ext/json/ext/generator/generator.c, which stops after encountering a 0 byte, returning a pointer to a string of length zero, not the length stored in space len. This can expose arbitrary memory during a JSON.generate call, potentially allowing a remote attacker to cause a denial of service.Recommendations
For Ruby versions prior to 2.2.8, update to version 2.2.8 or later.
For Ruby versions 2.3.x through 2.3.4, update to version 2.3.5 or later.
For Ruby versions 2.4.x through 2.4.1, update to version 2.4.2 or later.
As a temporary workaround, consider restricting the use of the
JSON.generate call until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾