CVE-2020-25739: XSS
Published Sep 23, 2020
·Updated
An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escapemode parameter to escape fields as an XSS protection mechanism. To mitigate, jsondumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
Affected Software
5 affected componentsFixes available
rubygems/gon<6.4.0
6.4.0
debian/ruby-gon
6.4.0-16.4.0-2
Gon Project Gon Ruby<6.4.0
Canonical Ubuntu Linux=18.04
Debian Debian Linux=9.0
Remediation
Event History
Sep 23, 2020
CVE Published
via MITRE·01:53 PM
Data Sourced
via MITRE·01:53 PM
Description
Data Sourced
via NVD·02:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 30, 2021
Advisory Published
05:29 PM
Jan 11, 2024
Data Sourced
via Launchpad·11:46 PM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·09:38 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-25739?
CVE-2020-25739 is classified as a medium severity vulnerability due to its potential for XSS attacks.
2
How do I fix CVE-2020-25739?
To fix CVE-2020-25739, upgrade the gon gem to version 6.4.0 or later.
3
Which versions of the gon gem are affected by CVE-2020-25739?
Versions of the gon gem prior to 6.4.0 are affected by CVE-2020-25739.
4
Is CVE-2020-25739 applicable to Debian packages?
Yes, versions of ruby-gon prior to 6.4.0-1 and 6.4.0-2 are vulnerable to CVE-2020-25739.
5
What types of systems are affected by CVE-2020-25739?
CVE-2020-25739 affects systems using the gon gem in Ruby applications, including Debian and Ubuntu installations.