Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

yajl-ruby

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9RubyGemsPublished

    Buffer Overflow in yajl-ruby

    CVE-2022-24795 · GHSA-jj47-x69x-mxrm

    Affected
    • RubyGems yajl-ruby <= 1.4.2
    Fixed in
    1.4.3· Vendor fix available
    Issue
    NOTE: A previous patch, 1.4.2, fixed the heap memory issue, but could still lead to a DoS infinite loop. Please update to version 1.4.3 The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. Details The reallocation logic at yajlbuf.c#L64 may result in the need 32bit integer wrapping to 0 when need approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf-alloc into a small heap chunk. These integers are declared as sizet in the 2.x branch of yajl, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which sizet is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. Impact We rate this as a moderate severity vulnerability which mostly impacts process availability…

    Recommended action: Upgrade to 1.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5RubyGemsPublished

    yajl-ruby gem Denial of Service vulnerability

    CVE-2017-16516 · GHSA-wwh7-4jw9-33x6

    Affected
    • RubyGems yajl-ruby < 1.3.1
    Fixed in
    1.3.1· Vendor fix available
    Issue
    In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service.

    Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →