[SECURITY] [DLA 2190-1] ruby-json security update

2020-04-2808:12:45

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

78.8%

JSON

Package : ruby-json
Version : 1.8.1-1+deb8u1
CVE ID : CVE-2020-10663

In ruby-json before 2.3.0, there is an unsafe object creation
vulnerability. When parsing certain JSON documents, the json
gem (including the one bundled with Ruby) can be coerced into
creating arbitrary objects in the target system.

For Debian 8 "Jessie", this problem has been fixed in version
1.8.1-1+deb8u1.

We recommend that you upgrade your ruby-json packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Best,
Utkarsh

OSVersionArchitecturePackageVersionFilename
Debian9mipsruby-json< 2.0.1+dfsg-3+deb9u1ruby-json_2.0.1+dfsg-3+deb9u1_mips.deb
Debian10amd64ruby2.5-dbgsym< 2.5.5-3+deb10u2ruby2.5-dbgsym_2.5.5-3+deb10u2_amd64.deb
Debian9s390xruby2.3-dev< 2.3.3-1+deb9u8ruby2.3-dev_2.3.3-1+deb9u8_s390x.deb
Debian10mipslibruby2.5< 2.5.5-3+deb10u2libruby2.5_2.5.5-3+deb10u2_mips.deb
Debian9arm64ruby2.3-tcltk< 2.3.3-1+deb9u8ruby2.3-tcltk_2.3.3-1+deb9u8_arm64.deb
Debian8amd64libruby2.1< 2.1.5-2+deb8u10libruby2.1_2.1.5-2+deb8u10_amd64.deb
Debian9arm64ruby-json-dbgsym< 2.0.1+dfsg-3+deb9u1ruby-json-dbgsym_2.0.1+dfsg-3+deb9u1_arm64.deb
Debian9armhfruby-json< 2.0.1+dfsg-3+deb9u1ruby-json_2.0.1+dfsg-3+deb9u1_armhf.deb
Debian8armellibruby2.1< 2.1.5-2+deb8u10libruby2.1_2.1.5-2+deb8u10_armel.deb
Debian10armelruby2.5-dbgsym< 2.5.5-3+deb10u2ruby2.5-dbgsym_2.5.5-3+deb10u2_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips	ruby-json	< 2.0.1+dfsg-3+deb9u1	ruby-json_2.0.1+dfsg-3+deb9u1_mips.deb
Debian	10	amd64	ruby2.5-dbgsym	< 2.5.5-3+deb10u2	ruby2.5-dbgsym_2.5.5-3+deb10u2_amd64.deb
Debian	9	s390x	ruby2.3-dev	< 2.3.3-1+deb9u8	ruby2.3-dev_2.3.3-1+deb9u8_s390x.deb
Debian	10	mips	libruby2.5	< 2.5.5-3+deb10u2	libruby2.5_2.5.5-3+deb10u2_mips.deb
Debian	9	arm64	ruby2.3-tcltk	< 2.3.3-1+deb9u8	ruby2.3-tcltk_2.3.3-1+deb9u8_arm64.deb
Debian	8	amd64	libruby2.1	< 2.1.5-2+deb8u10	libruby2.1_2.1.5-2+deb8u10_amd64.deb
Debian	9	arm64	ruby-json-dbgsym	< 2.0.1+dfsg-3+deb9u1	ruby-json-dbgsym_2.0.1+dfsg-3+deb9u1_arm64.deb
Debian	9	armhf	ruby-json	< 2.0.1+dfsg-3+deb9u1	ruby-json_2.0.1+dfsg-3+deb9u1_armhf.deb
Debian	8	armel	libruby2.1	< 2.1.5-2+deb8u10	libruby2.1_2.1.5-2+deb8u10_armel.deb
Debian	10	armel	ruby2.5-dbgsym	< 2.5.5-3+deb10u2	ruby2.5-dbgsym_2.5.5-3+deb10u2_armel.deb