PT-2017-2894 · Ruby+5 · Ruby+5
Published
2017-08-31
·
Updated
2020-06-09
·
CVE-2017-14064
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ruby versions prior to 2.2.8
Ruby versions 2.3.x through 2.3.4
Ruby versions 2.4.x through 2.4.1
Description
The issue lies in the use of
strdup in ext/json/ext/generator/generator.c, which stops after encountering a 0 byte, returning a pointer to a string of length zero, not the length stored in space len. This can expose arbitrary memory during a JSON.generate call, potentially allowing a remote attacker to cause a denial of service.Recommendations
For Ruby versions prior to 2.2.8, update to version 2.2.8 or later.
For Ruby versions 2.3.x through 2.3.4, update to version 2.3.5 or later.
For Ruby versions 2.4.x through 2.4.1, update to version 2.4.2 or later.
As a temporary workaround, consider restricting the use of the
JSON.generate call until a patch is available.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Ruby
Suse
Ubuntu