HIGH7.5

GHSA-pjj4-w39g-pw54

Ox gem crashes due to a crafted input

Quick fix

GHSA-pjj4-w39g-pw54 — ox: upgrade to the fixed version with the command below.

bundle update ox

Details

In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to `parse_obj`. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/ox

Introduced in: 0Fixed in: 2.8.1

Fixbundle update ox

References

https://nvd.nist.gov/vuln/detail/CVE-2017-15928[ADVISORY]
https://github.com/ohler55/ox/issues/194[WEB]
https://github.com/ohler55/ox[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ox/CVE-2017-15928.yml[WEB]
https://rubygems.org/gems/ox/versions/2.8.0[WEB]