The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-abrt | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygems-devel | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby19Upgrade ruby21Upgrade ruby20Upgrade rubygem-json | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Nov 12, 2020 |
| Centos_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade pcs-snmpUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-bson-debuginfoUpgrade rubygems-develUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-io-console-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade ruby-debugsourceUpgrade pcsUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade ruby-libs | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade ruby-irbUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-minitest | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade pcs-snmpUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade pcsUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade ruby-libs-debuginfoNo solution existsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfo | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.1Upgrade yast2-ruby-bindingsUpgrade ruby2.1-develUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-devel | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade ruby2.7Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.5Upgrade libruby2.7 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub