FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rubygem-json -- Unsafe Objection Creation Vulnerability in JSON (Additional fix)

Affected packages
rubygem-json <= 2.3.0

Details

VuXML ID 40194e1c-6d89-11ea-8082-80ee73419af3
Discovery 2020-03-19
Entry 2020-03-26

When parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system.

This is the same issue as CVE-2013-0269. The previous fix was incomplete, which addressed JSON.parse(user_input), but didn’t address some other styles of JSON parsing including JSON(user_input) and JSON.parse(user_input, nil).

See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a Denial of Service by creating many garbage-uncollectable Symbol objects, but this kind of attack is no longer valid because Symbol objects are now garbage-collectable. However, creating arbitrary bjects may cause severe security consequences depending upon the application code.

Please update the json gem to version 2.3.0 or later. You can use gem update json to update it. If you are using bundler, please add gem "json", ">= 2.3.0" to your Gemfile.

References

CVE Name CVE-2020-10663
URL https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/