GitHub Advisoryadvisory · RubyGems

GHSA-jphg-qwrw-7w9g Unsafe object creation in json RubyGem

HIGH Published 2020-07-27 Modified 2023-01-25 Official page ↗
Aliases
CVE-2020-10663
Ecosystem
RubyGems
Packages
json
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2020-07-27

Affected packages

• RubyGems json: < 2.3.0 → fixed in 2.3.0

Description

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Related

Alias · CVE (1)

  • CVE-2020-10663 The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References