14

I get the following error when running rspec after I added the vcr gem. Simply running gem install psych -- --enable-bundled-libyaml as suggested doesn't solve the problem. I am using rbenv and ruby-build and I am on ruby 2.1.1. What do i have to do to fix this?

SafeYAML Warning
  ----------------

  You appear to have an outdated version of libyaml (0.1.4) installed on your system.

  Prior to 0.1.6, libyaml is vulnerable to a heap overflow exploit from malicious YAML payloads.

  For more info, see:
  https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525/

  The easiest thing to do right now is probably to update Psych to the latest version and enable
  the 'bundled-libyaml' option, which will install a vendored libyaml with the vulnerability patched:

  gem install psych -- --enable-bundled-libyaml
Dominik Goltermann
  • 4,276
  • 2
  • 26
  • 32

5 Answers5

9

First, you have to update Ruby-build, they have recently patched this security issue. Now, it installs libyaml 0.1.6 to compile Ruby. 

$ rm -rf ~/.rbenv/plugins/ruby-build
$ git clone https://github.com/sstephenson/ruby-build.git ~/.rbenv/plugins/ruby-build

Recompile, reinstall the Ruby version you are using, 2.0.0-p451 in my case:

$ rbenv install 2.0.0-p451
rbenv: /home/ubuntu/.rbenv/versions/2.0.0-p451 already exists
continue with installation? (y/N) y
Downloading yaml-0.1.6.tar.gz...
-> http://dqw8nmjcqpjn7.cloudfront.net/5fe00cda18ca5daeb43762b80c38e06e
...

And it worked in my case.

David Clavijo
  • 387
  • 1
  • 11
4

I just followed the instructions in this reply https://stackoverflow.com/a/9510209/816002 and it seems to have done the trick. I did it slightly different however:

rvm pkg install libyaml
rvm get stable
rvm reinstall all --force

This might not help if you are using system Ruby, and will obviously be different with rbenv.

Community
  • 1
  • 1
squarefrog
  • 4,750
  • 4
  • 35
  • 64
  • 1
    For some reason on osx (10.9.2) rvm pkg install libyaml is installing 0.1.5, so this doesn't do anything for me. – TKH Apr 07 '14 at 22:56
  • @TKH see if this answer helps: http://stackoverflow.com/questions/22919990/rails-psych-updating-libyaml-from-0-1-4 – ouranos Apr 09 '14 at 00:08
  • @ouranos seems like brew already had 0.1.6 installed. tried reinstalling to no avail. :( – TKH Apr 09 '14 at 17:17
  • Mine failed on `Fetching yaml-0.1.4.tar.gz` with a 404 error for https://rvm.io/src/yaml-0.1.4.tar.gz – Sarah Vessels Apr 30 '14 at 16:55
3

As a user of rvm, I managed to get my set up to play ball by building 0.1.6 release of libyaml, then (re)installing Ruby, passing the following configure flag

rvm install 1.9.3 -- --with-libyaml-dir=/usr/local

Hope this helps people in the short-term until the dust settles.

codeasone
  • 1,953
  • 2
  • 23
  • 30
  • Of all the suggestions on the linked posts about this issue... this one worked! I had to reinstall the gem causing the issue after this, but then it worked! Reinstalling the gem without this rvm install did not fix the issue. – ATSiem Apr 12 '14 at 19:10
0

If you're on Mac OS X / Mavericks then you may be running on the system-installed Ruby. Thoughbot encourages you not to do this. I was having this problem as well, so I followed their advice and installed brew and rbenv and the problem went away.

Simon Woodside
  • 7,175
  • 5
  • 50
  • 66
0

For rvm this worked for me:

rvm pkg install libyaml
$LIBYAML_PATH will be the path where RVM installs the upated yaml
rvm get stable
rvm reinstall all --force --with-libyaml-dir=$LIBYAML_PATH

http://synaptian.com/2014/04/fixing-the-safeyaml-warning-on-ubuntu-12-04-with-rvm/

hamdiakoguz
  • 15,795
  • 9
  • 33
  • 27