CVE-2013-0269

Name	CVE-2013-0269
Description	The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-215-1, DLA-263-1
Debian Bugs	700436, 700471

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-json (PTS)	buster	2.1.0+dfsg-2+deb10u1	fixed
	bullseye	2.3.0+dfsg-1	fixed
	trixie, bookworm, sid	2.6.3+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libjson-ruby	source	squeeze	1.1.9-1+deb6u1	DLA-215-1
libjson-ruby	source	(unstable)	(unfixed)
ruby-json	source	(unstable)	1.7.3-3		700436
ruby1.8	source	(unstable)	(not affected)
ruby1.9.1	source	squeeze	1.9.2.0-2+deb6u5	DLA-263-1
ruby1.9.1	source	(unstable)	1.9.3.194-7		700471

- ruby1.8 <not-affected> (json ext not present in 1.8)