Skip to content

jruby affected by libyaml CVE-2014-2525? #1612

@jk779

Description

@jk779

Hey,
I'm currently reviewing some servers and rvm installations regarding this issue: https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525/

I was curious if a jruby installation (via rvm) is also affected. I've read here that jruby is using an own implementation of libyaml and thus should not have the same bugs.
However I would feel better if you could confirm that jruby is not affected by this issue.

I'm using jruby 1.7.3 (1.9.3p385) 2013-02-21 dac429b on Java HotSpot(TM) 64-Bit Server VM 1.7.0_07-b10 [linux-amd64]

Thanks,
Michael

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions