Improper Input Validation

Affecting ruby2.3 package, versions <2.3.3-1+deb9u8

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

References

CVSS Score

7.5
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    High
  • Availability
    None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVE
CVE-2020-10663
CWE
CWE-20
Snyk ID
SNYK-DEBIAN9-RUBY23-567460
Disclosed
28 Apr, 2020
Published
25 Apr, 2020