The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-abrt-doc | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-net-telnetUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-bundler | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby20Upgrade rubygem-jsonUpgrade ruby19Upgrade ruby24Upgrade ruby21 | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Nov 12, 2020 |
| Centos_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-bsonUpgrade pcsUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-power_assertUpgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-pg-debugsourceUpgrade pcs-snmpUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bson-debuginfo | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade pcsUpgrade rubygems-develUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubygem-mongo-docUpgrade rubygem-power_assert | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade pcs-snmpUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongoUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-pg-debuginfoUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-abrtUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade ruby-docUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygemsUpgrade rubygem-did_you_meanNo solution existsUpgrade rubygem-mysql2-docUpgrade pcsUpgrade rubygem-mongo-docUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-openssl | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-psych | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade ruby2.1-devel | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.7Upgrade libruby2.3Upgrade libruby2.7Upgrade ruby2.5 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub