Debian update for ruby2.5

Published: 2020-07-09

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-10663 CVE-2020-10933
CWE-ID	CWE-20 CWE-200
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Debian Linux Operating systems & Components / Operating system ruby2.5 (Debian package) Operating systems & Components / Operating system package or component
Vendor	Debian

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU32971

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10663

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Mitigation

Update ruby2.5 package to version 2.5.5-3+deb10u2.

Vulnerable software versions

Debian Linux: All versions

ruby2.5 (Debian package): before 2.5.5-3+deb10u2

CPE2.3

External links

https://www.debian.org/security/2020/dsa-4721

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU31886

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-10933

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor