CVE-2017-14064

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.2.8 Ruby versions 2.3.x through 2.3.4 Ruby versions 2.4.x through 2.4.1

Description The issue lies in the use of strdup in ext/json/ext/generator/generator.c, which stops after encountering a 0 byte, returning a pointer to a string of length zero, not the length stored in space len. This can expose arbitrary memory during a JSON.generate call, potentially allowing a remote attacker to cause a denial of service.

Recommendations For Ruby versions prior to 2.2.8, update to version 2.2.8 or later. For Ruby versions 2.3.x through 2.3.4, update to version 2.3.5 or later. For Ruby versions 2.4.x through 2.4.1, update to version 2.4.2 or later. As a temporary workaround, consider restricting the use of the JSON.generate call until a patch is available.