Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
Weakness
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Json | Ruby-lang | 2.14.0 (including) | 2.15.2.1 (excluding) |
| Json | Ruby-lang | 2.16.0 (including) | 2.17.1.2 (excluding) |
| Json | Ruby-lang | 2.18.0 (including) | 2.19.2 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | ruby4.0-0:4.0.3-34.el10_2 | * |
| Red Hat Enterprise Linux 9 | RedHat | ruby:4.0-9080020260513131334.9 | * |
| Ruby-json | Ubuntu | esm-apps/xenial | * |