CVE-2024-35221
Denial of service when publishing a package on rubygems.org
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Denial of service when publishing a package on rubygems.org
Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.
Reserved 2024-05-14 | Published 2024-05-29 | Updated 2024-08-02 | Assigner GitHub_MCWE-400: Uncontrolled Resource Consumption
github.com/...ms.org/security/advisories/GHSA-4vc5-whwr-7hh2
en.wikipedia.org/wiki/Billion_laughs_attack
github.com/...67d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb
Support options
