The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-abrt | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade ruby-tcltkUpgrade rubygem-power_assert | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby21Upgrade ruby24Upgrade ruby19Upgrade ruby20Upgrade rubygem-json | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Nov 12, 2020 |
| Centos_linux | — | Upgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade pcsUpgrade rubygemsUpgrade rubygem-psych-debuginfoUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-pgUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade rubygem-bson-debugsourceUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade ruby-docUpgrade pcs-snmpUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-irbUpgrade rubygem-io-console-debuginfo | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubygemsUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-mongoUpgrade rubygem-did_you_meanUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade pcsUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-bundler-doc | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-irbUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongoUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade pcs-snmpUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-psychNo solution existsUpgrade rubygem-mysql2-docUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade pcsUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfo | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfo | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade ruby2.1Upgrade libruby2_5-2_5Upgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.5Upgrade libruby2.3Upgrade ruby2.7Upgrade libruby2.7Upgrade ruby2.5 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub