Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 636474 (CVE-2017-16516) - <dev-ruby/yajl-ruby-1.3.1: crafted JSON file causes ruby process crashes with a SIGABRT
Summary: <dev-ruby/yajl-ruby-1.3.1: crafted JSON file causes ruby process crashes with...
Status: RESOLVED FIXED
Alias: CVE-2017-16516
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://github.com/brianmario/yajl-ru...
Whiteboard: C3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-03 23:57 UTC by Aleksandr Wagner (Kivak)
Modified: 2018-07-13 20:38 UTC (History)
1 user (show)

See Also:
Package list:
dev-ruby/yajl-ruby-1.3.1
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-11-03 23:57:56 UTC
CVE-2017-16516 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16516):

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service. 

References:

https://github.com/brianmario/yajl-ruby/issues/176
https://rubygems.org/gems/yajl-ruby
Comment 1 Hans de Graaff gentoo-dev 2017-11-04 05:48:53 UTC
We will wait for an upstream fix.
Comment 2 Larry the Git Cow gentoo-dev 2017-11-08 06:37:02 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e5171d48f94f79e2a8c7eecd21a5917416eb9d9a

commit e5171d48f94f79e2a8c7eecd21a5917416eb9d9a
Author:     Hans de Graaff <graaff@gentoo.org>
AuthorDate: 2017-11-08 06:36:26 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2017-11-08 06:36:43 +0000

    dev-ruby/yajl-ruby: add 1.3.1, fixing bug 636474
    
    Bug: https://bugs.gentoo.org/636474
    Package-Manager: Portage-2.3.8, Repoman-2.3.3

 dev-ruby/yajl-ruby/Manifest               |  1 +
 dev-ruby/yajl-ruby/yajl-ruby-1.3.1.ebuild | 45 +++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)}
Comment 3 Hans de Graaff gentoo-dev 2018-04-06 04:53:30 UTC
Please test and mark 1.3.1 stable.
Comment 4 Larry the Git Cow gentoo-dev 2018-04-06 14:26:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2cf203c0967df5bfc083532dc953d543b74e840a

commit 2cf203c0967df5bfc083532dc953d543b74e840a
Author:     Aaron Bauman <bman@gentoo.org>
AuthorDate: 2018-04-06 14:25:58 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2018-04-06 14:26:20 +0000

    dev-ruby/yajl-ruby: amd64 stable
    
    Bug: https://bugs.gentoo.org/636474
    Package-Manager: Portage-2.3.28, Repoman-2.3.9

 dev-ruby/yajl-ruby/yajl-ruby-1.3.1.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)}
Comment 5 Tobias Klausmann gentoo-dev 2018-04-06 17:14:13 UTC
Stable on alpha.
Comment 6 Sergei Trofimovich gentoo-dev 2018-04-07 11:36:10 UTC
ia64 stable
Comment 7 Thomas Deutschmann gentoo-dev Security 2018-04-11 20:39:33 UTC
x86 stable
Comment 8 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2018-04-28 07:23:41 UTC
arm stable
Comment 9 Larry the Git Cow gentoo-dev 2018-06-24 20:22:56 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=739f624bb8ef4251299f831e7e3eacd3ef7baa92

commit 739f624bb8ef4251299f831e7e3eacd3ef7baa92
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2018-06-24 19:46:56 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2018-06-24 20:20:19 +0000

    dev-ruby/yajl-ruby: stable 1.3.1 for ppc64, bug #636474
    
    Bug: https://bugs.gentoo.org/636474
    Package-Manager: Portage-2.3.40, Repoman-2.3.9
    RepoMan-Options: --include-arches="ppc64"

 dev-ruby/yajl-ruby/yajl-ruby-1.3.1.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 10 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2018-07-11 23:55:31 UTC
ppc stable
Comment 11 Rolf Eike Beer 2018-07-13 14:50:08 UTC
Sparc done.
Comment 12 Larry the Git Cow gentoo-dev 2018-07-13 18:46:21 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b03eebfb5f8b07b94873d1ca9a7bdc4f19439e41

commit b03eebfb5f8b07b94873d1ca9a7bdc4f19439e41
Author:     Rolf Eike Beer <eike@sf-mail.de>
AuthorDate: 2018-07-13 14:41:32 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2018-07-13 18:46:06 +0000

    dev-ruby/yajl-ruby: stable 1.3.1 for sparc
    
    Bug: https://bugs.gentoo.org/636474
    Package-Manager: Portage-2.3.40, Repoman-2.3.9
    RepoMan-Options: --include-arches="sparc"

 dev-ruby/yajl-ruby/yajl-ruby-1.3.1.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 13 Hans de Graaff gentoo-dev 2018-07-13 19:03:56 UTC
Cleanup done.
Comment 14 Michael Boyle 2018-07-13 19:34:11 UTC
Thank you. Waiting to see if this is good for a glsa.

Michael Boyle
Gentoo Security Padawan
Comment 15 Yury German Gentoo Infrastructure gentoo-dev Security 2018-07-13 20:38:16 UTC
GLSA Vote: No
Thank you all for you work. 
Closing as [noglsa]