The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
References
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
07 Nov 2023, 03:14
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
28 Mar 2023, 18:06
Type | Values Removed | Values Added |
---|---|---|
CPE |
18 Apr 2022, 15:21
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | |
First Time |
Apache
Apache zookeeper |
|
References | (MLIST) https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory |
22 Sep 2021, 14:22
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:* |
04 Apr 2021, 07:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
29 Jan 2021, 16:33
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:apple:mac_os:11.0.1:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
References | (FULLDISC) http://seclists.org/fulldisclosure/2020/Dec/32 - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3Cdev.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/ - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/ - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/ - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20210129-0003/ - Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2020/dsa-4721 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3Cissues.zookeeper.apache.org%3E - Mailing List, Third Party Advisory | |
References | (CONFIRM) https://support.apple.com/kb/HT211931 - Third Party Advisory |
29 Jan 2021, 07:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
06 Jan 2021, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2020-04-28 21:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-10663
Mitre link : CVE-2020-10663
CVE.ORG link : CVE-2020-10663
JSON object : View
Products Affected
json_project
- json
opensuse
- leap
debian
- debian_linux
ruby-lang
- ruby
apple
- macos
fedoraproject
- fedora
CWE
CWE-20
Improper Input Validation