Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

json

6 known vulnerabilities (3 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 high, 1 low
Registry
RubyGems

Advisories 6

  • Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

    Affected: from 2.20.0, fixed in 2.21.2.

  • Ruby JSON: JSON generator heap buffer overflow when streaming to an IO

    Affected: from 2.9.0, fixed in 2.19.9.

  • Ruby JSON has a format string injection vulnerability

    Affected: from 2.18.0, fixed in 2.19.2; from 2.16.0, fixed in 2.17.1.2; from 2.14.0, fixed in 2.15.2.1.

  • Ruby JSON Parser has Out-of-bounds Read

    Affected: from 2.10.0, fixed in 2.10.2.

  • The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object…

    Affected: fixed in 2.3.0.

  • The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service…

    Affected: fixed in 1.5.5; from 1.6.0, fixed in 1.6.8; from 1.7.0, fixed in 1.7.7.