CVE-2020-10663

NameCVE-2020-10663
DescriptionThe JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2190-1, DLA-2192-1, DSA-4721-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-json (PTS)buster2.1.0+dfsg-2+deb10u1fixed
bullseye2.3.0+dfsg-1fixed
bookworm, sid2.5.1+dfsg-2fixed
ruby2.5 (PTS)buster, buster (security)2.5.5-3+deb10u4fixed
ruby2.7 (PTS)bullseye (security), bullseye2.7.4-1+deb11u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby-jsonsourcejessie1.8.1-1+deb8u1DLA-2190-1
ruby-jsonsourcestretch2.0.1+dfsg-3+deb9u1
ruby-jsonsourcebuster2.1.0+dfsg-2+deb10u1
ruby-jsonsource(unstable)2.3.0+dfsg-1
ruby2.1sourcejessie2.1.5-2+deb8u10DLA-2192-1
ruby2.1source(unstable)(unfixed)
ruby2.3sourcestretch2.3.3-1+deb9u8
ruby2.3source(unstable)(unfixed)
ruby2.5sourcebuster2.5.5-3+deb10u2DSA-4721-1
ruby2.5source(unstable)(unfixed)
ruby2.7source(unstable)(not affected)

Notes

- ruby2.7 <not-affected> (Fixed before initial upload to Debian)
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
https://hackerone.com/reports/706934
https://github.com/ruby/ruby/commit/36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 (2.6.6)
https://github.com/ruby/ruby/commit/b379ecd8b6832dfcd5dad353b6bfd41701e2d678 (2.5.8)

Search for package or bug name: Reporting problems