The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-abrt-doc | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-did_you_meanUpgrade rubygem-net-telnetUpgrade ruby-libs | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade rubygem-jsonUpgrade ruby20Upgrade ruby21Upgrade ruby19Upgrade ruby24 | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Apr 28, 2020 |
| Centos_linux | — | Upgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade pcsUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade ruby-docUpgrade rubyUpgrade pcs-snmpUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubygem-io-console-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-bigdecimal-debuginfo | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade rubyUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade pcsUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-bundler-doc | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develNo solution existsUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-bson-docUpgrade pcsUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-mongo-docUpgrade rubygems-develUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade rubyUpgrade pcs-snmpUpgrade rubygem-bson-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsource | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade ruby-develUpgrade rubygem-pg | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade ruby2.1-stdlibUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.1Upgrade ruby2.1-develUpgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1 | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade ruby2.3Upgrade ruby2.7Upgrade libruby2.5Upgrade libruby2.3Upgrade libruby2.7Upgrade ruby2.5 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub