Description
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose
arbitrary memory during a JSON.generate call. The issues lies in using
strdup in ext/json/ext/generator/generator.c, which will stop after
encountering a '\0' byte, returning a pointer to a string of length zero,
which is not the length stored in space_len.
Package
| Upstream: | needs-triage
|
| Ubuntu 18.04 LTS: | DNE
|
| Ubuntu 14.04 ESM: | DNE
(trusty was released [1.9.3.484-2ubuntu1.5])
|
Patches:
Package
| Upstream: | needs-triage
|
| Ubuntu 18.04 LTS: | DNE
|
| Ubuntu 14.04 ESM: | DNE
(trusty was released [2.0.0.484-1ubuntu2.10])
|
Patches:
Package
| Upstream: | needs-triage
|
| Ubuntu 18.04 LTS: | DNE
|
| Ubuntu 16.04 ESM: | released
(2.3.1-2~16.04.5)
|
| Ubuntu 14.04 ESM: | DNE
|
Patches:
Updated: 2022-04-13 12:55:09 UTC (commit f411bd370d482ef4385c4e751d121a4055fbc009)