CVE-2013-0269

2013-02-1301:55:05

Debian Security Bug Tracker

security-tracker.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.019 Low

EPSS

Percentile

88.5%

JSON

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka “Unsafe Object Creation Vulnerability.”

OSVersionArchitecturePackageVersionFilename
Debian12allruby-json< 1.7.3-3ruby-json_1.7.3-3_all.deb
Debian11allruby-json< 1.7.3-3ruby-json_1.7.3-3_all.deb
Debian999allruby-json< 1.7.3-3ruby-json_1.7.3-3_all.deb
Debian13allruby-json< 1.7.3-3ruby-json_1.7.3-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	ruby-json	< 1.7.3-3	ruby-json_1.7.3-3_all.deb
Debian	11	all	ruby-json	< 1.7.3-3	ruby-json_1.7.3-3_all.deb
Debian	999	all	ruby-json	< 1.7.3-3	ruby-json_1.7.3-3_all.deb
Debian	13	all	ruby-json	< 1.7.3-3	ruby-json_1.7.3-3_all.deb