CVE-2020-10663 (High) detected in json-1.8.6.gem

[mend-bolt-for-github]

CVE-2020-10663 - High Severity Vulnerability

Vulnerable Library - json-1.8.6.gem

This is a JSON implementation as a Ruby extension in C.

Library home page: https://rubygems.org/gems/json-1.8.6.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/json-1.8.6.gem

Dependency Hierarchy:

• github-pages-112.gem (Root Library)
  • jekyll-mentions-1.2.0.gem
    • activesupport-4.2.7.gem
      • ❌ json-1.8.6.gem (Vulnerable Library)

Found in HEAD commit: 7874f1a89a7ab0c4d9a4080ff5baa89d00a714f1

Found in base branch: master

Vulnerability Details

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Publish Date: 2020-04-28

URL: CVE-2020-10663

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Release Date: 2020-04-28

Fix Resolution: 2.3.0

---

Step up your Open Source Security Game with Mend here