Arbitrary Memory Exposure in Ruby Package - CVE-2017-14064
Summary
ALPINE-CVE-2017-14064: Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. Affects ruby versions < 2.4.2-r0. Fixed in 2.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development, particularly with the Ruby on Rails framework. The Ruby package in Alpine Linux distributions is essential for running Ruby applications. However, it has been found to be vulnerable to a specific issue that can lead to arbitrary memory exposure during JSON generation.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14064, affects Ruby versions up to 2.4.1. It arises from the use of the strdup function in the JSON generator, which stops processing upon encountering a null byte ('\0'). This can result in a pointer being returned to a string of length zero, which does not match the expected length stored in space_len. Consequently, this flaw can expose arbitrary memory, potentially leading to information disclosure or exploitation by attackers.
How To Fix
Minimum fixed version
2.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider avoiding the use of the JSON.generate method in your Ruby applications until the package is updated. Alternatively, you can implement input validation to sanitize data before processing it with JSON methods.
Conclusion
CVE-2017-14064 is a critical vulnerability in Ruby that can lead to arbitrary memory exposure during JSON generation. It is essential to update to the patched version to safeguard your applications. Utilizing tools like Vulert can help monitor vulnerabilities effectively.
See every vulnerability recorded for ruby →
FAQ
CVE-2017-14064 is a vulnerability in Ruby that can expose arbitrary memory during JSON generation, potentially leading to information disclosure.
Ruby versions up to 2.4.1 are affected by this vulnerability. It is recommended to upgrade to version 2.4.2-r0 or later.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2017-14064 is 9.8, indicating a critical level of severity.
If you cannot update Ruby right away, avoid using JSON.generate in your applications and validate inputs to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
