The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-pg-doc | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rdocUpgrade rubyUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade ruby-tcltkUpgrade ruby-devel | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby20Upgrade rubygem-jsonUpgrade ruby24Upgrade ruby19Upgrade ruby21 | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Apr 28, 2020 |
| Centos_linux | — | Upgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade pcsUpgrade rubygemsUpgrade rubygem-test-unitUpgrade ruby-debugsourceUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-io-console-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade pcs-snmpUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-mysql2-debugsourceUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-mysql2-doc | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade rubygem-irbUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade pcsUpgrade rubygem-rdocUpgrade rubygem-net-telnet | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-mysql2-debuginfoUpgrade pcsUpgrade rubygem-mysql2-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-json-debuginfoNo solution existsUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-mongoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade pcs-snmpUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-pg-debuginfoUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubyUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-io-console | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade ruby-devel | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade libruby2_5-2_5 | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.7Upgrade ruby2.5Upgrade libruby2.7 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub