Vulnerabilities

 1 via 13 paths

Dependencies

 68

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity

Use After Free

  • Vulnerable module: json
  • Introduced through: rubocop-rspec@3.10.2, rubocop-thread_safety@0.7.3 and others

Detailed paths

  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › rubocop-rspec@3.10.2 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to rubocop-rspec@3.10.2.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › rubocop-thread_safety@0.7.3 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to rubocop-thread_safety@0.7.3.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-custom@1.0.2 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-custom@1.0.2.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard@1.56.0 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard@1.56.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › searxng@0.2.0 › fast-mcp@1.6.0 › json@2.21.1
    Remediation: Upgrade to searxng@0.2.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-rspec@0.5.0 › rubocop-rspec@3.10.2 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-rspec@0.5.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard@1.56.0 › standard-custom@1.0.2 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard@1.56.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-performance@1.9.0 › rubocop-performance@1.26.1 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-performance@1.9.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-rspec@0.5.0 › rubocop-capybara@2.23.0 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-rspec@0.5.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-rspec@0.5.0 › rubocop-factory_bot@2.28.0 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-rspec@0.5.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-rspec@0.5.0 › rubocop-rspec_rails@2.32.0 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-rspec@0.5.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard-rspec@0.5.0 › rubocop-rspec_rails@2.32.0 › rubocop-rspec@3.10.2 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard-rspec@0.5.0.
  • Introduced through: amkisko/searxng.rb@amkisko/searxng.rb › standard@1.56.0 › standard-performance@1.9.0 › rubocop-performance@1.26.1 › rubocop@1.88.2 › json@2.21.1
    Remediation: Upgrade to standard@1.56.0.

Overview

json is a JSON implementation as a Ruby extension in C.

Affected versions of this package are vulnerable to Use After Free through JSON::ResumableParser#partial_value in ext/json/ext/parser/parser.c. An attacker can crash the Ruby process by supplying truncated streaming JSON with duplicate object keys and causing the application to call partial_value on the incomplete parse. The vulnerable warning path computes a cursor position for resumable-parser deprecation messages after the parser has already cleared and released its input buffer, leaving stale pointers in state.start, state.cursor, and state.end. When that duplicate-key path runs, it dereferences freed memory and terminates the process.

Remediation

Upgrade json to version 2.21.2 or higher.

References

Use After Free vulnerability report