The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg-doc | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-json | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby20Upgrade rubygem-jsonUpgrade ruby21Upgrade ruby24Upgrade ruby19 | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Apr 28, 2020 |
| Centos_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-abrtUpgrade rubygem-bson-debugsourceUpgrade pcs-snmpUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-psych-debuginfoUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-xmlrpcUpgrade ruby-debugsourceUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-net-telnet | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade pcsUpgrade rubygems-develUpgrade rubygem-bundler-docUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-pg-doc | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygems-develUpgrade pcsUpgrade rubygem-bson-docUpgrade rubygemsNo solution existsUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade rubygem-bigdecimal-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-mongoUpgrade rubygem-pg-debuginfoUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-pg-debugsourceUpgrade pcs-snmpUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundlerUpgrade ruby-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-irb | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-bson | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade ruby2.1Upgrade ruby2.1-develUpgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1 | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.7Upgrade ruby2.5Upgrade libruby2.7 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub