# Security Fix json-1.1.7 for json\_pure and json gems **URL:** \ **Category:** Ruby\ **Created:** [June 30, 2009, 7:19pm UTC](https://www.ruby-forum.com/t/security-fix-json-1-1-7-for-json-pure-and-json-gems/171328 "2009-06-30T19:19:20Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Florian\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/4da419/32.png) [@Florian\_F](https://www.ruby-forum.com/u/Florian_F)\ **Post date:** [June 30, 2009, 7:19pm UTC](https://www.ruby-forum.com/t/security-fix-json-1-1-7-for-json-pure-and-json-gems/171328/1 "2009-06-30T19:19:20Z")
# Synopsis Security Fix Release json-1.1.7 for json\_pure and json gems. # Description The JSON::Pure::Parser contains a vulnerability that may lead to catastrophic backtracking in one of its regular expressions. This vulnerability doesn’t affect the JSON::Ext::Parser or Rail’s Active::Support::JSON. Ruby 1.9.1 (but not Ruby 1.9 trunk) contains the vulnerable json/pure code as well, so if you want to use the pure parser you should update to a newer version or use the json gem 1.1.7 version. # Impact An attacker can cause a denial of service attack by passing a specially designed string into the JSON::Pure::Parser#parse method. # Affected versions - versions 1.1.0-1.1.6 of the JSON::Pure::Parser # Credit Thanks to Bartosz Blimke for reporting this bug. # Changes 2009-06-29 (1.1.7) - Security Fix for JSON::Pure::Parser. A specially designed string could cause catastrophic backtracking in one of the parser’s regular expressions in earlier 1.1.x versions. JSON::Ext::Parser isn’t affected by this issue. Thanks to Bartosz Blimke [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) for reporting this problem. - This release also uses a less strict ruby version requirement for the creation of the mswin32 native gem. # Download Version 1.1.7 of json and json\_pure on [http://rubyforge.org/frs/?group\_id=953](http://rubyforge.org/frs/?group_id=953)