CVE-2014-10077

Vulnerability

The Hash#slice method in lib/i18n/core_ext/hash.rb of the i18n gem (versions before 0.8.0) for Ruby crashes the application when called with a keep_keys array containing a key that does not exist in the original hash. This is due to the method not checking for key existence before attempting to access it. Affected versions: all prior to 0.8.0. [1][3]

Exploitation

An attacker can trigger this vulnerability by providing input that causes the application to call Hash#slice with a keep_keys parameter that includes a key not present in the hash. No authentication or special privileges are required if the application exposes this functionality to user input. The attack does not require user interaction beyond normal usage. [1][3]

Impact

Successful exploitation results in a denial of service (application crash). The vulnerability does not lead to information disclosure, privilege escalation, or remote code execution. The impact is limited to availability. [1][4]

Mitigation

The fix was released in i18n version 0.8.0 on January 10, 2015. Users should upgrade to 0.8.0 or later. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. [3][4]