CVE-2020-10663 Unsafe object creation in json RubyGem
Attackers can exploit unsafe object creation in the Ruby JSON gem to potentially execute arbitrary code or cause application-dependent adverse effects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10663?
CVE-2020-10663 is a high-severity unsafe deserialization vulnerability in Apple Macos, published on 28 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Weakness: CWE-20
Which versions are affected by CVE-2020-10663?
2 open source packages ship an affected version, including json. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
json RubyGems | All versions | 2.3.0 |
json RubyGems | All versions | 2.3.0 |
Linux distribution packages (15)
pcs Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.4-6.el8_2.1 |
pcs-snmp Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.4-6.el8_2.1 |
pcs Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.4-6.el8_2.1 |
pcs-snmp Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.4-6.el8_2.1 |
pcs Red Hat:rhel_e4s:8.0::highavailability | All versions | 0:0.10.1-4.el8_0.5 |
pcs-snmp Red Hat:rhel_e4s:8.0::highavailability | All versions | 0:0.10.1-4.el8_0.5 |
pcs Red Hat:rhel_eus:8.1::highavailability | All versions | 0:0.10.2-4.el8_1.1 |
pcs-snmp Red Hat:rhel_eus:8.1::highavailability | All versions | 0:0.10.2-4.el8_1.1 |
pcs Red Hat:rhel_eus:8.1::resilientstorage | All versions | 0:0.10.2-4.el8_1.1 |
pcs-snmp Red Hat:rhel_eus:8.1::resilientstorage | All versions | 0:0.10.2-4.el8_1.1 |
ruby3.2-rubygem-json_pure openSUSE:Tumbleweed | All versions | 2.6.3-1.3 |
rubygem-json_pure openSUSE:Tumbleweed | All versions | 2.6.1-1.1 |
rubygem-json_pure openSUSE:Tumbleweed | All versions | 2.7.1-1.1 |
rubygem-json_pure openSUSE:Tumbleweed | All versions | 2.7.6-1.3 |
rubygem-json_pure openSUSE:Tumbleweed | All versions | 2.7.6-1.5 |
Products include Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Json Project Json, Opensuse Leap.
How do I fix CVE-2020-10663?
Upgrade json to 2.3.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-10663 being exploited?
There is no known exploitation of CVE-2020-10663 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2020-10663, CLEANSTART-2026-ZF36625, DEBIAN-CVE-2020-10663, DLA-2190-1, DLA-2192-1, GHSA-jphg-qwrw-7w9g and 11 more.