{"id":"CVE-2017-14064","details":"Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.","modified":"2026-08-18T08:26:21.759077Z","published":"2017-08-31T17:29:00.183Z","related":["SUSE-SU-2020:1570-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"17.10"},{"last_affected":"17.10"}]},{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_desktop"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.5"},{"last_affected":"7.5"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_eus"},{"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_workstation"}]},"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/100890"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1039363"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1042004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3485"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0378"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0583"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0585"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201710-18"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3685-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2017/dsa-3966"},{"type":"ADVISORY","url":"https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/"},{"type":"ADVISORY","url":"https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/"},{"type":"FIX","url":"https://bugs.ruby-lang.org/issues/13853"},{"type":"FIX","url":"https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85"},{"type":"EVIDENCE","url":"https://hackerone.com/reports/209949"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/json","events":[{"introduced":"0"},{"fixed":"8f782fd8e181d9cfe9387ded43a5ca9692266b85"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.0.2","v2.0.1","v2.0.0","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.7","v1.6.7","v1.5.4","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.4-java","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.2.0","v1.1.8"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14064.json","vanir_signatures_modified":"2026-08-18T08:26:21Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.c","function":"cState_array_nl_set"},"deprecated":false,"digest":{"function_hash":"333850170000569990630816245825851334286","length":412},"id":"CVE-2017-14064-081830d4"},{"target":{"file":"ext/json/ext/generator/generator.c","function":"cState_indent_set"},"deprecated":false,"digest":{"function_hash":"148811423845304250804089795861570238355","length":436},"id":"CVE-2017-14064-3bbe9110","signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85"},{"id":"CVE-2017-14064-44119ad3","signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.c","function":"cState_object_nl_set"},"deprecated":false,"digest":{"function_hash":"235138498165329040769513923872404799455","length":413}},{"source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.c","function":"cState_space_set"},"deprecated":false,"digest":{"function_hash":"231212006610800307331410088410461672189","length":434},"id":"CVE-2017-14064-49101875","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.h"},"deprecated":false,"digest":{"line_hashes":["120904374308355083734111949005929042523","26452857847874449151212129149641036903"],"threshold":0.9},"id":"CVE-2017-14064-6910d9a7","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"178352657454531393926190957860867963360","length":207},"id":"CVE-2017-14064-709f6fe5","signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.c","function":"fstrndup"}},{"source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["203126428726097578240407651447407768962","193928348062049476056199914767292540998","18992539843680518976943110175587805218","318507856882490173243287007951430614995","331377055305598866239756616680018855666","178811035994741578769452089321787285767","203432646838676032209194061565332159502","79145566861867884141474191602216982759","14118550392830535240411748288371500960","141107907040637505627201232328272113840","4488029395062862805420548455971309090","216554920298105624124125028082587199942","58217186119402190294095398429532077133","154268555576477752669255655074285455849","116938978129615895259416110858600871365","26272765290950953135327040711027961691","42657249236710796016958936661343165221","187518194052195544513889556210237749823","335178387273758271688706615039113585731","59048560601979423467278544029286927301","12602922004186724451618902428544806050","211868815879659581706041366009915183192","173310494673434350338619270441623270086","275663103391244767528307132844466520875"]},"id":"CVE-2017-14064-bb2df37f","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"221211380026251280885482296555216767330","length":448},"id":"CVE-2017-14064-ffa02b53","signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85","target":{"file":"ext/json/ext/generator/generator.c","function":"cState_space_before_set"},"deprecated":false}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/ruby","events":[{"introduced":"0"},{"last_affected":"530165c2948c3eed741db5659f7b937270caa46a"},{"introduced":"d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20"},{"last_affected":"820605ba3c10b9f4dafc4e5d6e09765b8b31cbea"}],"database_specific":{"cpe":["cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"2.2.7"},{"introduced":"2.3.0"},{"last_affected":"2.3.0"},{"introduced":"2.3.0-preview1"},{"last_affected":"2.3.0-preview1"},{"introduced":"2.3.0-preview2"},{"last_affected":"2.3.0-preview2"},{"introduced":"2.3.1"},{"last_affected":"2.3.1"},{"introduced":"2.3.2"},{"last_affected":"2.3.2"},{"introduced":"2.3.3"},{"last_affected":"2.3.3"},{"introduced":"2.3.4"},{"last_affected":"2.3.4"},{"introduced":"2.4.0"},{"last_affected":"2.4.0"},{"introduced":"2.4.0-preview1"},{"last_affected":"2.4.0-preview1"},{"introduced":"2.4.0-preview2"},{"last_affected":"2.4.0-preview2"},{"introduced":"2.4.0-preview3"},{"last_affected":"2.4.0-preview3"},{"introduced":"2.4.0-rc1"},{"last_affected":"2.4.0-rc1"},{"introduced":"2.4.1"},{"last_affected":"2.4.1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["2.3.0","2.3.0-preview1","2.3.0-preview2","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.0-preview1","2.4.0-preview2","2.4.0-preview3","2.4.0-rc1","2.4.1","v2_2_7","v2_4_1","v2_2_0_rc1","v1_0_r2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14064.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}