CVE-2020-10663

NameCVE-2020-10663
DescriptionThe JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2190-1, DLA-2192-1, DSA-4721-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-json (PTS)stretch2.0.1+dfsg-3vulnerable
buster2.1.0+dfsg-2vulnerable
bullseye, sid2.3.0+dfsg-1fixed
ruby2.3 (PTS)stretch (security), stretch2.3.3-1+deb9u7vulnerable
ruby2.5 (PTS)buster2.5.5-3+deb10u1vulnerable
buster (security)2.5.5-3+deb10u2fixed
ruby2.7 (PTS)bullseye, sid2.7.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby-jsonsource(unstable)2.3.0+dfsg-1
ruby-jsonsourcejessie1.8.1-1+deb8u1DLA-2190-1
ruby2.1source(unstable)(unfixed)
ruby2.1sourcejessie2.1.5-2+deb8u10DLA-2192-1
ruby2.3source(unstable)(unfixed)
ruby2.5source(unstable)(unfixed)
ruby2.5sourcebuster2.5.5-3+deb10u2DSA-4721-1
ruby2.7source(unstable)(not affected)

Notes

[buster] - ruby-json <no-dsa> (Minor issue)
[stretch] - ruby-json <no-dsa> (Minor issue)
- ruby2.7 <not-affected> (Fixed before initial upload to Debian)
[stretch] - ruby2.3 <no-dsa> (Minor issue)
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
https://hackerone.com/reports/706934
https://github.com/ruby/ruby/commit/36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 (2.6.6)
https://github.com/ruby/ruby/commit/b379ecd8b6832dfcd5dad353b6bfd41701e2d678 (2.5.8)

Search for package or bug name: Reporting problems