Ruby · Report #235842

Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML

Validstatus

mediumseverity

3upvotes

25 Oct 2017disclosed

How it was found

libYAML 0.1.6 (and 0.1.5) has a DoS vulnerablitity known as CVE-2014-9130. Now Ruby 2.4.x bundles fixed version 0.1.7, but 2.3.x and 2.2.x still bundle 0.1.6.

Note that I'm the maintainer of Ruby 2.3.x and 2.2.x. Therefore, this report is a kind of remainder.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original