The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVE-2020-10663 - High Severity Vulnerability
This is a JSON implementation as a Ruby extension in C.
Library home page: https://rubygems.org/gems/json-1.8.6.gem
Path to dependency file: /fs-agent/src/test/resources/resolver/ruby/Gemfile.lock
Path to vulnerable library: /var/lib/gems/2.3.0/cache/json-1.8.6.gem
Dependency Hierarchy: - httparty-0.13.7.gem (Root Library) - :x: **json-1.8.6.gem** (Vulnerable Library)
Found in HEAD commit: 29e84fa404969236d780d54b2729db9ca633923b
Found in base branch: master
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Publish Date: 2020-04-28
URL: CVE-2020-10663
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
Release Date: 2020-04-28
Fix Resolution: 2.3.0