Description

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.

Remediation

References

CVE-2017-14064

Related Vulnerabilities

WordPress Plugin Events Made Easy PHP Object Injection (2.0.52)

PHP Out-of-bounds Write Vulnerability (CVE-2016-7127)

Apache Tomcat Improper Handling of Exceptional Conditions Vulnerability (CVE-2021-30639)

WebLogic Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Vulnerability (CVE-2021-28170)

MySQL CVE-2019-2494 Vulnerability (CVE-2019-2494)

Severity

Critical

Classification

CVE-2017-14064 CWE-119 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities