The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-abrt | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-json | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby19Upgrade ruby24Upgrade ruby21Upgrade ruby20Upgrade rubygem-json | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Nov 12, 2020 |
| Centos_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubygem-openssl-debuginfoUpgrade ruby-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade pcs-snmpUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-psych-debuginfoUpgrade pcsUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-json-debuginfo | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade pcsUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-xmlrpcUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade ruby | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade rubygems-develUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-rdocUpgrade rubygem-bsonUpgrade rubygem-bson-docNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade pcsUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfoUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubyUpgrade ruby-debugsourceUpgrade pcs-snmpUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-rake | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade rubygem-psych | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade ruby2.1Upgrade ruby2.1-develUpgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.1-stdlibUpgrade ruby2.5-devel | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade ruby2.7Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5Upgrade libruby2.7Upgrade ruby2.5 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub