[DRE-maint] Bug#880691: ruby-yajl: CVE-2017-16516

[Salvatore Bonaccorso]

Source: ruby-yajl
Version: 1.2.0-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/brianmario/yajl-ruby/issues/176

Hi,

the following vulnerability was published for ruby-yajl.

CVE-2017-16516[0]:
| In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is
| supplied to Yajl::Parser.new.parse, the whole ruby process crashes with
| a SIGABRT in the yajl_string_decode function in yajl_encode.c. This
| results in the whole ruby process terminating and potentially a denial
| of service.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16516
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16516
[1] https://github.com/brianmario/yajl-ruby/issues/176

Regards,
Salvatore