CVE-2020-10663

NameCVE-2020-10663
DescriptionThe JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2190-1, DLA-2192-1, DSA-4721-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-json (PTS)stretch2.0.1+dfsg-3+deb9u1fixed
buster2.1.0+dfsg-2+deb10u1fixed
bullseye, sid2.3.0+dfsg-1fixed
ruby2.3 (PTS)stretch2.3.3-1+deb9u8fixed
stretch (security)2.3.3-1+deb9u9fixed
ruby2.5 (PTS)buster, buster (security)2.5.5-3+deb10u2fixed
ruby2.7 (PTS)bullseye, sid2.7.2-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby-jsonsourcejessie1.8.1-1+deb8u1DLA-2190-1
ruby-jsonsourcestretch2.0.1+dfsg-3+deb9u1
ruby-jsonsourcebuster2.1.0+dfsg-2+deb10u1
ruby-jsonsource(unstable)2.3.0+dfsg-1
ruby2.1sourcejessie2.1.5-2+deb8u10DLA-2192-1
ruby2.1source(unstable)(unfixed)
ruby2.3sourcestretch2.3.3-1+deb9u8
ruby2.3source(unstable)(unfixed)
ruby2.5sourcebuster2.5.5-3+deb10u2DSA-4721-1
ruby2.5source(unstable)(unfixed)
ruby2.7source(unstable)(not affected)

Notes

- ruby2.7 <not-affected> (Fixed before initial upload to Debian)
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
https://hackerone.com/reports/706934
https://github.com/ruby/ruby/commit/36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 (2.6.6)
https://github.com/ruby/ruby/commit/b379ecd8b6832dfcd5dad353b6bfd41701e2d678 (2.5.8)

Search for package or bug name: Reporting problems