CVE-2017-16516: High severity yajl-ruby vulnerability
In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service.
Other sources
In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16516?
CVE-2017-16516 has a severity rating that can lead to denial of service due to process crashes.
How do I fix CVE-2017-16516?
To mitigate CVE-2017-16516, upgrade the yajl-ruby gem to version 1.3.1 or later.
Which versions of yajl-ruby are affected by CVE-2017-16516?
CVE-2017-16516 affects version 1.3.0 of the yajl-ruby gem.
What is the impact of CVE-2017-16516 on applications?
CVE-2017-16516 can cause applications using the affected yajl-ruby gem to crash unexpectedly.
Is there a workaround for CVE-2017-16516 until I can upgrade?
There isn’t a specific workaround for CVE-2017-16516; the best approach is to upgrade to a safe version.