Ruby JSON Format String Injection Vulnerability Leading to Denial-of-Service and Information Disclosure

A format string injection vulnerability has been identified in Ruby JSON versions 2.14.0 prior to 2.15.2.1, 2.17.1.2, and 2.19.2. This vulnerability can lead to denial-of-service attacks or information disclosure when the 'allow_duplicate_key: false' parsing option is used with user-supplied documents. The issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Impact

Exploitation of this vulnerability can cause denial-of-service conditions or unauthorized information disclosure.

Remediation

Users can upgrade to Ruby JSON versions 2.15.2.1, 2.17.1.2, or 2.19.2 to address this vulnerability. If an upgrade is not possible, the issue can be avoided by not using the 'allow_duplicate_key: false' parsing option.