CVE-2017-16516

Name of the Vulnerable Software and Affected Versions yajl-ruby gem version 1.3.0

Description The issue is related to insufficient processing of a format string in the yajl string decode function of the yajl encode.c component in the YAJL-ruby JSON library. When a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT, resulting in the termination of the ruby process and potentially a denial of service.

Recommendations For yajl-ruby gem version 1.3.0, consider avoiding the use of the Yajl::Parser.new.parse function with untrusted JSON files until a patch is available. As a temporary workaround, restrict the input to this function to prevent the exploitation of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.