JSON gem has Improper Input Validation vulnerability

🗓️ 24 Oct 2017 18:33:37Reported by GitHub Advisory DatabaseType

JSON gem vulnerability in versions before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 allows remote attackers to cause denial of service or bypass mass assignment protection mechanism via crafted JSON document triggering creation of arbitrary Ruby symbols or internal objects, leading to SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability.

Reporter	Title	Published	Views	Family All 78
Amazon	Medium: ruby20	12 Aug 202000:00	–	amazon
Amazon	Important: ruby24	31 Aug 202000:00	–	amazon
Amazon	Medium: rubygem-json	31 Aug 202000:00	–	amazon
Amazon	Medium: ruby19, ruby21	31 Aug 202000:00	–	amazon
Amazon	Medium: ruby	24 May 202100:00	–	amazon
Amazon	Important: ruby	25 Sep 202300:00	–	amazon
FreeBSD	Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON	11 Feb 201300:00	–	freebsd
CVE	CVE-2013-0269	13 Feb 201301:00	–	cve
Cvelist	CVE-2013-0269	13 Feb 201301:00	–	cvelist
Debian	[SECURITY] [DLA 215-1] libjson-ruby security update	30 Apr 201516:34	–	debian

Vulners

Node

json_project jsonRange1.7.0–1.7.7rubygems

json_project jsonRange1.6.0–1.6.8rubygems

json_project jsonRange<1.5.5rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-0269
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/82010
groups	www.groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428
lists	www.lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
lists	www.lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html
lists	www.lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
lists	www.lists.opensuse.org/opensuse-updates/2013-04/msg00034.html
rhn	www.rhn.redhat.com/errata/RHSA-2013-0686.html
rhn	www.rhn.redhat.com/errata/RHSA-2013-0701.html
rhn	www.rhn.redhat.com/errata/RHSA-2013-1028.html

06 Nov 2023 05:00Current

4.9Medium risk

Vulners AI Score4.9

CVSS 27.5

EPSS0.17317

CWE-20