Published: 13/02/2013 Updated: 09/12/2017
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

The JSON gem prior to 1.5.5, 1.6.x prior to 1.6.8, and 1.7.x prior to 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Affected Products

Vendor Product Versions
RubygemsJson Gem1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6

Vendor Advisories

Synopsis Moderate: ruby193-ruby, rubygem-json and rubygem-rdoc security update Type/Severity Security Advisory: Moderate Topic Updated ruby193-ruby, rubygem-json and rubygem-rdoc packages that fix twosecurity issues are now available for Red Hat OpenShift Enterprise 113The Red Hat Security Response Team ...
Debian Bug report logs - #700436 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] Package: ruby-json; Maintainer for ruby-json is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Source for ruby-json is src:ruby-json (PTS, buildd, popcon) Reported by: Ond ...
Synopsis Moderate: Subscription Asset Manager 121 update Type/Severity Security Advisory: Moderate Topic Red Hat Subscription Asset Manager 121, which fixes several securityissues, multiple bugs, and adds various enhancements, is now availableThe Red Hat Security Response Team has rated this update as ...
Several security issues were fixed in Ruby ...

Github Repositories

heroku-CVE-2013-0269 Inspect all of your heroku apps to see if they are running a vulnerable version of JSON Background A security vulnerability has been found in the Ruby JSON gem This is the root cause for the recently-announced MySQL injection issue in Rails A new release of the JSON gem is available Developers can get a full list of all your affected Heroku applications

Recent Articles

Ruby on Rails Patches DoS, Remote Execution Flaws
Threatpost • Chris Brook • 13 Feb 2013

Web app framework Ruby on Rails patched two security flaws this week in the open source framework that could have led to denial of service attacks and remote execution vulnerabilities.
With builds 3.2.12, 3.1.11 and 2.3.17, the framework fixed a serialized attributes YAML vulnerability (CVE-2013-0277) that could have let developers give users access to the +serialize+ helper in ActiveRecord. From there an attacker could have used a specially crafted request to trick the functio...