MEDIUM5.5

GHSA-wfwm-chj7-w59r

Ox gem stack overflow in sax_parse

Quick fix

GHSA-wfwm-chj7-w59r — ox: upgrade to the fixed version with the command below.

bundle update ox

Details

In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the `read_from_str` function in `sax_buf.c` when a crafted input is supplied to `sax_parse`.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/ox

Introduced in: 0Fixed in: 2.8.2

Fixbundle update ox

References

https://nvd.nist.gov/vuln/detail/CVE-2017-16229[ADVISORY]
https://github.com/ohler55/ox/issues/195[WEB]
https://github.com/ohler55/ox[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ox/CVE-2017-16229.yml[WEB]
https://rubygems.org/gems/ox/versions/2.8.1[WEB]