CVE编号
CVE-2020-10663利用情况
暂无补丁情况
官方补丁披露时间
2020-04-29漏洞描述
Ruby JSON gem是一款基于Ruby的用于从文本解析JSON以及从Ruby对象生成JSON文本的软件包。 Ruby JSON gem 2.2.0及之前版本（使用在Ruby 2.4版本至2.4.9版本、2.5版本至2.5.7版本和2.6版本至2.6.5版本）中存在安全漏洞。攻击者可利用该漏洞在目标系统中强制创建任意对象。解决建议
厂商已发布了漏洞修复程序，请及时关注更新：https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html | |
| http://seclists.org/fulldisclosure/2020/Dec/32 | |
| https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2... | |
| https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c7... | |
| https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b31... | |
| https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f689... | |
| https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d... | |
| https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727e... | |
| https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52... | |
| https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43... | |
| https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d894... | |
| https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://security.netapp.com/advisory/ntap-20210129-0003/ | |
| https://support.apple.com/kb/HT211931 | |
| https://www.debian.org/security/2020/dsa-4721 | |
| https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | json_project | json | * |
Up to (including) 2.2.0 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | ruby-lang | ruby | * |
From (including) 2.4.0 |
Up to (including) 2.4.9 |
||||
| 运行在以下环境 | |||||||||
| 应用 | ruby-lang | ruby | * |
From (including) 2.5.0 |
Up to (including) 2.5.7 |
||||
| 运行在以下环境 | |||||||||
| 应用 | ruby-lang | ruby | * |
From (including) 2.6.0 |
Up to (including) 2.6.5 |
||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | pcs | * |
Up to (excluding) 2.5.8-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | pcs | * |
Up to (excluding) 2.6.6-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | pcs | * |
Up to (excluding) 2.6.6-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | pcs | * |
Up to (excluding) 2.6.6-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | ruby | * |
Up to (excluding) 2.6.6-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | ruby | * |
Up to (excluding) 2.6.6-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | pcs | * |
Up to (excluding) 2.4.10-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | pcs | * |
Up to (excluding) 2.6.6-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | ruby | * |
Up to (excluding) 2.0.0.648-36.amzn2.0.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | pcs | * |
Up to (excluding) 2.6.14.4-2.12.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | ruby | * |
Up to (excluding) 1.4.1-107.module+el8.4.0+10830+bbd85cce |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | pcs | * |
Up to (excluding) 2.5.5-3+deb10u2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | pcs | * |
Up to (excluding) 2.1.5-2+deb8u2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | pcs | * |
Up to (excluding) 2.3.3-1+deb9u8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30 | pcs | * |
Up to (excluding) 2.2.0-202.fc30 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_31 | pcs | * |
Up to (excluding) 2.2.0-202.fc31 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | pcs | * |
Up to (excluding) 2.5.8-lp151.4.9.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | pcs | * |
Up to (excluding) 0.10.4-6.0.1.el8_2.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | ruby | * |
Up to (excluding) 1.4.1-107.module+el8.4.0+10830+bbd85cce |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | pcs | * |
Up to (excluding) 2.1.9-19.3.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | pcs | * |
Up to (excluding) 2.1.9-19.3.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | ruby | * |
Up to (excluding) 2.3.1-2~ubuntu16.04.15 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | ruby | * |
Up to (excluding) 2.5.1-1ubuntu1.8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | unionos_20 | ruby | * |
Up to (excluding) 2.1.0+dfsg-2+deb10u1 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...