ALPINE-CVE-2020-10663
ALPINE-CVE-2020-10663
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS 7.5 · High · Fix available
- Published
- Updated
Stack: system
Affected products and versions
ruby Alpine:v3.10
- Affected ranges
- ECOSYSTEM: < 2.5.8-r0
Update to 2.5.8-r0
ruby Alpine:v3.11
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.12
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.13
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.14
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.15
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.16
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.17
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.18
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.19
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.20
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.21
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.22
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.23
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.24
- Affected ranges
- ECOSYSTEM: < 2.6.6-r0
Update to 2.6.6-r0
ruby Alpine:v3.7
- Affected ranges
- ECOSYSTEM: < 2.4.10-r0
Update to 2.4.10-r0