Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package rubygem-mongo-doc  (opens in a new tab)

Threat Intelligence

EPSS
0.42% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-RUBYGEMMONGODOC-1485367
  • published26 Jul 2021
  • disclosed19 Mar 2020
Report a new vulnerability Found a mistake?

Introduced: 19 Mar 2020

CVE-2020-10663  (opens in a new tab)
CWE-20  (opens in a new tab)
CWE-94  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rubygem-mongo-doc package and not the rubygem-mongo-doc package as distributed by RHEL.

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

References