Input validation error in Ruby - CVE-2020-10663

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32971

Input validation error in Ruby - CVE-2020-10663

Published: April 28, 2020 / Updated: August 3, 2020


Vulnerability identifier: #VU32971
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10663
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.


Affected software

Ruby
Amazon Linux AMI
Debian Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Opensuse
Ubuntu
Fedora
Red Hat Software Collections
EMC Integrated Data Protection Appliance
ruby (Alpine package)
rh-ruby25-ruby (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
pcs (Red Hat package)
rubygem-json
libruby2.3 (Ubuntu package)
ruby2.3 (Ubuntu package)
libruby2.5 (Ubuntu package)
ruby2.5 (Ubuntu package)
ruby2.5 (Debian package)
ruby
rh-ruby26-ruby (Red Hat package)
ruby2.7 (Ubuntu package)
libruby2.7 (Ubuntu package)
IBM Cloud Foundry Migration Runtime
DataStage on Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
Dell EMC Data Protection Search
IBM Sterling Global Mailbox (GM)

How to mitigate CVE-2020-10663

Install update from vendor's website.

Ruby - update to 2.4.10
EMC Integrated Data Protection Appliance - update to 2.7.1
rh-ruby25-ruby (Red Hat package) - update to 2.5.9-9.el7
IBM Cloud Foundry Migration Runtime - update to 4.1.2
DataStage on Cloud Pak for Data - update to 4.8.5
Dell EMC Data Protection Search - update to 19.6.0
pcs (Red Hat package) - addressed in versions 0.10.1-4.el8_0.5, 0.10.2-4.el8_1.1, 0.10.4-6.el8_2.1
rubygem-json - addressed in versions 2.2.0-202.fc30, 2.2.0-202.fc31
libruby2.3 (Ubuntu package) - update to 2.3.1-2~ubuntu16.04.15
ruby2.3 (Ubuntu package) - update to 2.3.1-2~ubuntu16.04.15
libruby2.5 (Ubuntu package) - update to 2.5.1-1ubuntu1.8
ruby2.5 (Ubuntu package) - update to 2.5.1-1ubuntu1.8
ruby2.5 (Debian package) - update to 2.5.5-3+deb10u2
ruby - update to 2.6.6-125.fc31
rh-ruby26-ruby (Red Hat package) - update to 2.6.7-119.el7
ruby2.7 (Ubuntu package) - addressed in versions 2.7.0-5ubuntu1.3, 2.7.1-3ubuntu1.2
libruby2.7 (Ubuntu package) - addressed in versions 2.7.0-5ubuntu1.3, 2.7.1-3ubuntu1.2
IBM Cloud Pak for Watson AIOps - update to 3.6.1
IBM Sterling Global Mailbox (GM) - update to 6.1.2.1

External References

Related Security Bulletins