VDB
ALPINE-CVE-2020-10663
ALPINE-CVE-2020-10663
PUBLISHED
CVSS 7.5 HIGH
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Risk Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.15 | ruby | 0, *, * |
| Alpine:v3.10 | ruby | 2.4.0-r3, 2.4.1-r5, 2.4.1-r4 |
| Alpine:v3.16 | ruby | 2.3.3-r3, 1.8.7_p160-r2, 1.8.7_p160-r3 |
| Alpine:v3.23 | ruby | 0, 0, 0 |
| Alpine:v3.22 | ruby | 0, 0, 0 |
| Alpine:v3.19 | ruby | 2.6.3-r0, 2.5.5-r0, 2.5.0-r1 |
| Alpine:v3.18 | ruby | 1.9.3_p385-r0, 1.8.7_p160-r2, 2.6.5-r2 |
| Alpine:v3.20 | ruby | 0, 0, 0 |
| Alpine:v3.13 | ruby | 1.8.7_p174-r1, 0, 1.8.7_p160-r2 |
| Alpine:v3.14 | ruby | 2.6.5-r2, 2.6.5-r1, 2.6.5-r0 |
| Alpine:v3.12 | ruby | 2.2.2-r1, 2.5.0-r1, 2.5.0-r0 |
| Alpine:v3.11 | ruby | 1.8.7_p160-r3, 1.8.7_p174-r0, 1.8.7_p174-r1 |
| Alpine:v3.21 | ruby | 0, 0, 0 |
| Alpine:v3.7 | ruby | *, 0, 1.8.7_p160-r2 |
| Alpine:v3.17 | ruby | 1.8.7_p72-r2, 1.8.7_p72-r1, 1.8.7_p358-r1 |
Timeline
- Apr 28, 2020 CVE Published
- Dec 3, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch