Description
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2022-21619 Vulnerability (CVE-2022-21619)
Apache HTTP Server Resource Management Errors Vulnerability (CVE-2016-1546)
Apache Tomcat Other Vulnerability (CVE-2001-1563)
IBM RTC Improper Restriction of XML External Entity Reference Vulnerability (CVE-2016-0219)
WordPress Plugin Contact Form 7 Integrations Multiple Cross-Site Scripting Vulnerabilities (1.3.10)