Vulnerability · Published Apr 28, 2020 · Assigned by mitre
CVE-2020-10663
High 7.5
In plain English
A high-severity security flaw in the rubygem-abrt package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.8% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)6.8%top 6.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+259+8cec6917 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+259+8cec6917 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-bson | 4.5.0-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-bson | 4.5.0-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-bson-doc | 4.5.0-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-bson-doc | 4.5.0-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mongo | 2.8.0-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mongo | 2.8.0-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mongo-doc | 2.8.0-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mongo-doc | 2.8.0-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.2-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.2-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.2-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.2-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-pg | 1.1.4-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-pg | 1.0.0-2.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-pg | 1.0.0-2.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-pg | 1.1.4-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-pg-doc | 1.0.0-2.module_el8.5.0+2625+ec418553 | ALSA-2021:2587 |
| AlmaLinux:8 | rubygem-pg-doc | 1.1.4-1.module_el8.5.0+2623+08a8ba32 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-pg-doc | 1.1.4-1.module_el8.5.0+250+ba22dbf7 | ALSA-2021:2588 |
| AlmaLinux:8 | rubygem-pg-doc | 1.0.0-2.module_el8.5.0+259+8cec6917 | ALSA-2021:2587 |
| Alpine:v3.20 | ruby | 2.6.6-r0 | ALPINE-CVE-2020-10663 |
| Alpine:v3.21 | ruby | 2.6.6-r0 | ALPINE-CVE-2020-10663 |
| Alpine:v3.22 | ruby | 2.6.6-r0 | ALPINE-CVE-2020-10663 |
| Alpine:v3.23 | ruby | 2.6.6-r0 | ALPINE-CVE-2020-10663 |
| Alpine:v3.24 | ruby | 2.6.6-r0 | ALPINE-CVE-2020-10663 |
| Debian:12 | ruby-json | 2.3.0+dfsg-1 | DEBIAN-CVE-2020-10663 |
| Debian:13 | ruby-json | 2.3.0+dfsg-1 | DEBIAN-CVE-2020-10663 |
| Debian:14 | ruby-json | 2.3.0+dfsg-1 | DEBIAN-CVE-2020-10663 |
| Rocky Linux:8 | ruby | 0:2.5.9-107.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| Rocky Linux:8 | ruby | 0:2.6.7-107.module+el8.4.0+593+8d7f9f0c | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.3.0+167+5c390590 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.4.0+592+03ff458a | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.3.0+167+5c390590 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-bson | 0:4.5.0-1.module+el8.4.0+446+80b53620 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-bson | 0:4.3.0-2.module+el8.3.0+167+5c390590 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-bson | 0:4.3.0-2.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-bson | 0:4.5.0-1.module+el8.4.0+593+8d7f9f0c | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-bundler | 0:1.16.1-3.module+el8.3.0+167+5c390590 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-bundler | 0:1.16.1-3.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-mongo | 0:2.8.0-1.module+el8.4.0+446+80b53620 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-mongo | 0:2.5.1-2.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-mongo | 0:2.8.0-1.module+el8.4.0+593+8d7f9f0c | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-mongo | 0:2.5.1-2.module+el8.4.0+349+3470f258 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.2-1.module+el8.4.0+446+80b53620 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.3.0+167+5c390590 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.2-1.module+el8.5.0+738+032c9c02 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.5.0+739+43897a5e | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.2-1.module+el8.4.0+593+8d7f9f0c | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-pg | 0:1.1.4-1.module+el8.4.0+593+8d7f9f0c | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-pg | 0:1.1.4-1.module+el8.4.0+446+80b53620 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-pg | 0:1.1.4-1.module+el8.5.0+738+032c9c02 | RLSA-2021:2588 |
| Rocky Linux:8 | rubygem-pg | 0:1.0.0-2.module+el8.3.0+167+5c390590 | RLSA-2021:2587 |
| Rocky Linux:8 | rubygem-pg | 0:1.0.0-2.module+el8.4.0+592+03ff458a | RLSA-2021:2587 |
| RubyGems | json | 2.3.0 | GHSA-jphg-qwrw-7w9g |
Affected products (as reported)
References
- https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ x_refsource_CONFIRM
- [debian-lts-announce] 20200430 [SECURITY] [DLA 2192-1] ruby2.1 security update mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:0586 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-26df92331a vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-d171bf636d vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-a95706b117 vendor-advisory, x_refsource_FEDORA
- DSA-4721 vendor-advisory, x_refsource_DEBIAN
- [zookeeper-dev] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20200913 [jira] [Resolved] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20200930 [jira] [Comment Edited] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20200930 [jira] [Commented] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20200930 [jira] [Issue Comment Deleted] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- https://support.apple.com/kb/HT211931 x_refsource_CONFIRM
- 20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1 mailing-list, x_refsource_FULLDISC
- [zookeeper-issues] 20210106 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20210129-0003/ x_refsource_CONFIRM
- [zookeeper-issues] 20210404 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20210404 [jira] [Assigned] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712 mailing-list, x_refsource_MLIST