Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursorposition, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partialvalue on incomplete attacker-controlled input containing duplicate object keys. The issue was reproduced in the native C extension from the official RubyGems releases: JSON 2.20.0 JSON 2.21.0 JSON 2.21.1 The attached evidence demonstrates: an AddressSanitizer-confirmed heap-use-after-free; a native SIGSEGV using the official JSON 2.21.1 RubyGem; an end-to-end loopback TCP attacker/victim reproduction; four…
Recommended action: Upgrade to 2.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash / denial of service. This was triaged on HackerOne as report #3785370. The issue was confirmed there and I was asked to open it here. Details Root cause is in ext/json/fbuffer/fbuffer.h, fbufferdoinccapa(). On the IO path, the buffer is grown to FBUFFERIOBUFFERSIZE (16383), but the early return checks total capacity instead of remaining capacity: If fb-len already contains JSON syntax bytes, and a string flush has 16383 - fb-len <= requested < 16383, this check returns even though there is not enough space left. fbufferappendreserved() then writes past the buffer: The minimal fix is to compare against the remaining capacity: PoC Verified results: Control: the same data through…
Recommended action: Upgrade to 2.19.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allowduplicatekey: false parsing option is used to parse user supplied documents. This option isn't the default, if you didn't opt-in to use it, you are not impacted. Patches Patched in 2.19.2. Workarounds The issue can be avoided by not using the allowduplicatekey: false parsing option.
Recommended action: Upgrade to 2.19.2, 2.17.1.2 or 2.15.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. Patches Version 2.10.2 fixes the problem. Workarounds None.
Recommended action: Upgrade to 2.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Recommended action: Upgrade to 2.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Recommended action: Upgrade to 1.7.7, 1.6.8 or 1.5.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.