treym-wss / ruby-nessus Goto Github PK

Vulnerable Library - json-2.2.0.gem

This is a JSON implementation as a Ruby extension in C.

Library home page: https://rubygems.org/gems/json-2.2.0.gem

Dependency Hierarchy:

• coveralls-0.8.23.gem (Root Library)
  • simplecov-0.16.1.gem
    • ❌ json-2.2.0.gem (Vulnerable Library)

Found in HEAD commit: 255d4a5ce6c31416c6967bc11a978a0e9befc911

Found in base branch: master

Vulnerability Details

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Publish Date: 2020-04-28

URL: CVE-2020-10663

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Release Date: 2020-03-28

Fix Resolution: 2.3.0