Skip to content

security: update fastlane and json gem to remediate CVE-2025-27788#16941

Open
jeevaratnamputla wants to merge 2 commits intojitsi:masterfrom
jeevaratnamputla:CVE-2025-27788
Open

security: update fastlane and json gem to remediate CVE-2025-27788#16941
jeevaratnamputla wants to merge 2 commits intojitsi:masterfrom
jeevaratnamputla:CVE-2025-27788

Conversation

@jeevaratnamputla
Copy link

Summary
This PR updates the fastlane and json Ruby dependencies to remediate a High-severity vulnerability (CVE-2025-27788) affecting the json gem.

Vulnerability Details
CVE ID: CVE-2025-27788

Severity: High (CVSS 7.5)

Issue: An out-of-bounds read vulnerability in the json gem (versions 2.10.0 and 2.10.1) that can lead to application crashes or denial of service when parsing malformed JSON input.

Impact on Jitsi: Affects the development/automation toolchain (fastlane) used for mobile deployments.

Changes
Gemfile: Updated fastlane from gem "fastlane" to gem "fastlane", "~> 2.232".

Gemfile.lock:

Upgraded fastlane from 2.226.0 to 2.232.1.

Upgraded json from vulnerable version 2.10.1 to patched version 2.11.3.

Why this approach?
Instead of forcing a version pin on the transitive json dependency, I have updated the parent fastlane gem to its latest stable version. This ensures that the dependency tree remains healthy and compatible with the official fastlane requirements while resolving the security risk.

AI Disclosure & Verification
AI Tooling: This vulnerability was identified and analyzed with the assistance of AI(OpsMx-AI- Guardian)

Human Verification: The vulnerability was manually verified against the Ruby Advisory Database. The resulting Gemfile.lock changes were audited to ensure no breaking major-version jumps were introduced to other dependencies.

@jitsi-jenkins
Copy link

Hi, thanks for your contribution!
If you haven't already done so, could you please make sure you sign our CLA (https://jitsi.org/icla for individuals and https://jitsi.org/ccla for corporations)? We would unfortunately be unable to merge your patch unless we have that piece :(.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants