The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-abrt | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade ruby-tcltkUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-net-telnet | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby21Upgrade ruby19Upgrade ruby24Upgrade ruby20Upgrade rubygem-json | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Apr 28, 2020 |
| Centos_linux | — | Upgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-did_you_meanUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debuginfoUpgrade pcs-snmpUpgrade rubygem-bson-debugsourceUpgrade pcsUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-json-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfo | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-pg-docUpgrade rubygem-did_you_meanUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade pcsUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-test-unit | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade rubygem-psychUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bsonUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongoUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade pcs-snmpUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubyUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-openssl-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2-docUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade pcsUpgrade rubygem-mongo-docUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalNo solution exists | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-bson-debuginfo | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade ruby2.1-develUpgrade ruby2.1Upgrade yast2-ruby-bindingsUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.1-stdlib | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.7Upgrade libruby2.3Upgrade ruby2.5Upgrade libruby2.7 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub