What’s Vulnerable › Vulnerabilities
CVE-2020-10663: Unsafe object creation in json RubyGem
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-04-28 · updated 2026-06-17
- Weakness: CWE-20
Description
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Affected products
- Apple macOS: 11.0.1
- Debian Linux: 8.0, 10.0
- Fedoraproject Fedora: 30, 31
- Json Project Json: through 2.2.0
- openSUSE Leap: 15.1
- Rubygems Json: before 2.3.0; 0.4.0, 0.4.1, 0.4.2, 0.4.3, 1.0.0, 1.0.1 (+62) — fixed in 2.3.0
How to fix
Upgrade to a fixed version: Rubygems Json 2.3.0. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html
Get alerted when CVE-2020-10663 or the next vulnerability affects your stack