CVE-2014-10077: Improper Input Validation

November 6, 2018 (updated December 13, 2018)

Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.

References

github.com/rubysec/ruby-advisory-db/pull/182/files
github.com/svenfuchs/i18n/pull/289
github.com/svenfuchs/i18n/releases/tag/v0.8.0
lists.debian.org/debian-lts-announce/2018/11/msg00021.html
nvd.nist.gov/vuln/detail/CVE-2014-10077

Code Behaviors & Features

Detect and mitigate CVE-2014-10077 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →