p PatchFirst

CVE-2020-10663

CVE-2020-10663

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

CVSS 7.5 · High · EPSS 6.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ruby-json Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.3.0+dfsg-1

    Update to 2.3.0+dfsg-1

  • ruby-json Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.3.0+dfsg-1

    Update to 2.3.0+dfsg-1

  • ruby-json Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.3.0+dfsg-1

    Update to 2.3.0+dfsg-1

  • ruby-json Ubuntu:14.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.0-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.3 Ubuntu:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    • 2.3.1-2~16.04.12
    • 2.3.1-2~ubuntu16.04.13
    • 2.3.1-2~ubuntu16.04.14
    Affected ranges
    • ECOSYSTEM: < 2.3.1-2~ubuntu16.04.15

    Update to 2.3.1-2~ubuntu16.04.15

  • ruby-json Ubuntu:16.04:LTS

    Versions
    • 1.8.3-1build1
    • 1.8.3-1build2
    • 1.8.3-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.5 Ubuntu:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    • 2.5.1-1ubuntu1.2
    • 2.5.1-1ubuntu1.4
    • 2.5.1-1ubuntu1.5
    • 2.5.1-1ubuntu1.6
    • 2.5.1-1ubuntu1.7
    Affected ranges
    • ECOSYSTEM: < 2.5.1-1ubuntu1.8

    Update to 2.5.1-1ubuntu1.8

  • ruby-json Ubuntu:18.04:LTS

    Versions
    • 2.1.0+dfsg-1
    • 2.1.0+dfsg-1ubuntu2
    • 2.1.0+dfsg-1ubuntu3
    • 2.1.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →