VDB
ALPINE-CVE-2020-10663
ALPINE-CVE-2020-10663
PUBLISHED
CVSS 7.5 HIGH
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.15 | ruby | 0, 2.6.3-r0, 2.5.5-r0 |
| Alpine:v3.10 | ruby | 2.4.0-r3, 2.4.1-r5, 2.4.1-r4 |
| Alpine:v3.16 | ruby | 2.4.1-r1, 1.8.7_p160-r2, 1.8.7_p160-r3 |
| Alpine:v3.23 | ruby | 0, 0, 0 |
| Alpine:v3.22 | ruby | 0, 0, 0 |
| Alpine:v3.19 | ruby | 2.5.0-r1, 2.5.0-r0, 2.3.2-r0 |
| Alpine:v3.24 | ruby | 0, 0 |
| Alpine:v3.18 | ruby | 1.9.3_p327-r0, 1.8.7_p160-r2, 0 |
| Alpine:v3.20 | ruby | 0, 0, 0 |
| Alpine:v3.13 | ruby | 1.8.7_p174-r2, 0, 1.8.7_p160-r2 |
| Alpine:v3.14 | ruby | 0, 0, 2.6.5-r2 |
| Alpine:v3.12 | ruby | 2.2.1-r0, 2.5.0-r1, 2.5.0-r0 |
| Alpine:v3.11 | ruby | 1.8.7_p160-r3, 1.8.7_p174-r0, 1.8.7_p174-r1 |
| Alpine:v3.21 | ruby | 0, 0, 0 |
| Alpine:v3.7 | ruby | *, 0, 1.8.7_p160-r2 |
| Alpine:v3.17 | ruby | 1.9.3_p286-r2, 1.9.3_p286-r1, 1.8.7_p72-r2 |
Timeline
- Apr 28, 2020 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated