The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-bson | May 4, 2022 | Apr 28, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Apr 28, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade ruby-libs | May 26, 2021 | Apr 28, 2020 |
| Amazon_linux | — | Upgrade ruby20Upgrade rubygem-jsonUpgrade ruby21Upgrade ruby19Upgrade ruby24 | Aug 13, 2020 | Mar 19, 2020 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 13, 2020 | Apr 28, 2020 |
| Centos_linux | — | Upgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade ruby-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade pcs-snmpUpgrade ruby-irbUpgrade rubygem-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-mysql2-debugsource | Jun 11, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade ruby-json | Apr 29, 2020 | Apr 29, 2020 |
| Freebsd | — | Upgrade rubygem-json | Mar 27, 2020 | Mar 26, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jun 17, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jun 3, 2020 | Apr 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | Apr 28, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade rubygem-irbUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-net-telnetUpgrade pcsUpgrade ruby-irbUpgrade rubygem-abrt-docUpgrade rubygem-bundler-doc | Jun 13, 2020 | Mar 19, 2020 |
| Redhat_linux | — | Upgrade rubygem-bsonUpgrade rubygem-psychNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade pcs-snmpUpgrade ruby-debugsourceUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubygem-bson-docUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade pcsUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-pg | Jun 11, 2020 | Apr 28, 2020 |
| Rocky_linux | — | Upgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfo | May 5, 2022 | Apr 28, 2020 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5-devel-extraUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.1-stdlibUpgrade ruby2.5-doc | May 7, 2020 | Mar 19, 2020 |
| Ubuntu | — | Upgrade ruby2.7Upgrade libruby2.5Upgrade libruby2.3Upgrade ruby2.3Upgrade ruby2.5Upgrade libruby2.7 | Mar 19, 2021 | Mar 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub