The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-json | Jul 30, 2024 | Feb 13, 2013 |
| Freebsd | — | Upgrade rubygem19-jsonUpgrade rubygem18-json_pureUpgrade rubyUpgrade rubygem19-json_pureUpgrade rubygem18-json | Dec 10, 2025 | Feb 16, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Feb 12, 2013 |
| Suse | — | Upgrade ruby-debugsourceUpgrade ruby-doc-htmlUpgrade rubyUpgrade ruby19-tkUpgrade ruby19Upgrade ruby-tk-debuginfoUpgrade rubygem-json_pureUpgrade ruby19-develUpgrade ruby-debuginfoUpgrade ruby19-doc-riUpgrade ruby19-devel-extraUpgrade ruby-examplesUpgrade ruby-doc-riUpgrade ruby-commonUpgrade ruby-tkUpgrade ruby-test-suiteUpgrade sle-sdk-releaseUpgrade ruby-devel | Feb 17, 2015 | Feb 12, 2013 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade libruby1.9.1 | Nov 8, 2024 | Feb 13, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub