The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulner...
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2020-10663 ruby 修正版: 2.5.8-r0
- Debian DEBIAN-CVE-2020-10663 ruby-json 修正版: 2.3.0+dfsg-1
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory lists.opensuse.org
- advisory seclists.org
- advisory lists.debian.org
- advisory security.netapp.com
- advisory support.apple.com
- advisory debian.org
- advisory ruby-lang.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org