CVE-2020-10663: Input Validation
A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269.
Other sources
In rubygem-json before 2.3.0 there is an unsafe object creation vulnerability. When parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269.
References:
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
— Red Hat
Ruby. This issue was addressed with improved checks.
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/jsonto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
redhat/pcsto a version that resolves this vulnerability.Fixed in 0:0.10.4-6.el8_2.1 - Upgrade
Upgrade
redhat/pcsto a version that resolves this vulnerability.Fixed in 0:0.10.1-4.el8_0.5 - Upgrade
Upgrade
redhat/pcsto a version that resolves this vulnerability.Fixed in 0:0.10.2-4.el8_1.1 - Upgrade
Upgrade
redhat/rh-ruby25-rubyto a version that resolves this vulnerability.Fixed in 0:2.5.9-9.el7 - Upgrade
Upgrade
redhat/rh-ruby26-rubyto a version that resolves this vulnerability.Fixed in 0:2.6.7-119.el7 - Upgrade
Upgrade
debian/ruby-jsonto a version that resolves this vulnerability.Fixed in 2.1.0+dfsg-2+deb10u1Fixed in 2.3.0+dfsg-1Fixed in 2.6.3+dfsg-1 - Upgrade
Upgrade
debian/ruby2.5to a version that resolves this vulnerability.Fixed in 2.5.5-3+deb10u4Fixed in 2.5.5-3+deb10u6 - Upgrade
Upgrade
debian/ruby2.7to a version that resolves this vulnerability.Fixed in 2.7.4-1+deb11u1 - Upgrade
Upgrade
Apple macOSto a version that resolves this vulnerability.Fixed in 11.0.1 - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Ensure untrusted user input is never passed to: JSON(user_input), JSON.parse(user_input, nil), JSON::Parser.new(user_input).parse, or JSON[user_input, nil].
Ruby json gem (JSON parsing) Unsafe object creation via JSON parsing methods = Do not supply untrusted input to JSON parsing methods - Compensating control
If any JSON parsing is required, only allow JSON strings originating from trusted sources for the json gem (including the one bundled with Ruby).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2020-27914
- CVE-2020-27915
- CVE-2020-27903
- CVE-2020-27910
- CVE-2020-27916
- CVE-2020-9943
- CVE-2020-9944
- CVE-2020-27906
- CVE-2020-27945
- CVE-2020-27908
- CVE-2020-27909
- CVE-2020-9960
- CVE-2020-10017
- CVE-2020-9949
- CVE-2020-9897
- CVE-2020-9883
- CVE-2020-10003
- CVE-2020-27922
- CVE-2020-9999
- CVE-2020-27937
- CVE-2020-9965
- CVE-2020-9966
- CVE-2020-27894
- CVE-2020-36615
- CVE-2021-1790
- CVE-2021-1775
- CVE-2020-29629
- CVE-2020-27942
- CVE-2020-9962
- CVE-2020-27952
- CVE-2020-9956
- CVE-2020-27931
- CVE-2020-27930
- CVE-2020-27927
- CVE-2020-29639
- CVE-2020-10002
- CVE-2020-9978
- CVE-2020-9955
- CVE-2020-27924
- CVE-2020-27912
- CVE-2020-27923
- CVE-2020-9876
- CVE-2020-10015
- CVE-2020-27897
- CVE-2020-27907
- CVE-2020-27919
- CVE-2020-9967
- CVE-2020-9975
- CVE-2020-27921
- CVE-2020-27904
- CVE-2019-14899
- CVE-2020-27950
- CVE-2020-9974
- CVE-2020-10016
- CVE-2020-27932
- CVE-2020-27917
- CVE-2020-27920
- CVE-2020-27911
- CVE-2020-9971
- CVE-2020-10014
- CVE-2020-10010
- CVE-2020-9941
- CVE-2020-9988
- CVE-2020-9989
- CVE-2020-10011
- CVE-2020-13524
- CVE-2020-10004
- CVE-2020-9996
- CVE-2020-27901
- CVE-2020-27900
- CVE-2019-20838
- CVE-2020-14155
- CVE-2020-10007
- CVE-2020-27896
- CVE-2020-9963
- CVE-2020-10012
- CVE-2020-10663
- CVE-2020-9945
- CVE-2020-9977
- CVE-2020-9942
- CVE-2020-9987
- CVE-2021-1803
- CVE-2020-9969
- CVE-2020-27893
- CVE-2021-1755
- CVE-2020-10005
- CVE-2020-9991
- CVE-2020-9849
- CVE-2020-15358
- CVE-2020-13631
- CVE-2020-13434
- CVE-2020-13435
- CVE-2020-13630
- CVE-2020-27899
- CVE-2020-10009
- CVE-2020-10008
- CVE-2020-27918
- CVE-2020-9947
- CVE-2020-9950
- CVE-2020-27898
- CVE-2020-27935
- CVE-2020-10006
Frequently Asked Questions
What is CVE-2020-10663?
CVE-2020-10663 is an Unsafe Object Creation Vulnerability in the JSON gem for Ruby.
What software is affected by CVE-2020-10663?
Ruby versions 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5 are affected by CVE-2020-10663.
How severe is CVE-2020-10663?
CVE-2020-10663 has a severity value of 7, which is considered high.
What is the remedy for CVE-2020-10663?
To fix CVE-2020-10663, update your Ruby installation to a version that includes the fix.
Where can I find more information about CVE-2020-10663?
You can find more information about CVE-2020-10663 on the CVE website, NIST vulnerability database, Ruby's official website, and Red Hat's bugzilla and errata pages.