1. Home
  2. Security Advisories
  3. Amazon Linux
  4. ALAS-2020-1423

[ALAS-2020-1423] Amazon Linux AMI 2014.03 - ALAS-2020-1423: medium priority package update for rubygem-json

Severity Medium
Affected Packages 22
CVEs 1
Info Packages References Vulnerabilities

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2020-10663:
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
1827500: CVE-2020-10663 rubygem-json: Unsafe Object Creation Vulnerability in JSON

Package Affected Version
pkg:rpm/amazonlinux/rubygem23-json?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem23-json?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem23-json-doc?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem23-json-doc?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem22-json?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem22-json?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem22-json-doc?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem22-json-doc?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem21-json?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem21-json?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem21-json-doc?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem21-json-doc?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem20-json?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem20-json?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem20-json-doc?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem20-json-doc?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem18-json?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem18-json?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem18-json-doc?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem18-json-doc?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem-json-debuginfo?arch=x86_64&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
pkg:rpm/amazonlinux/rubygem-json-debuginfo?arch=i686&distro=amazonlinux-1 < 1.8.3-1.53.amzn1
ID
ALAS-2020-1423
Severity
medium
URL
https://alas.aws.amazon.com/ALAS-2020-1423.html
Published
2020-08-26T23:09:00
(4 years ago)
Modified
2020-08-31T20:20:00
(4 years ago)
Rights
Amazon Linux Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/rubygem23-json?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem23-json < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem23-json?arch=i686&distro=amazonlinux-1 amazonlinux rubygem23-json < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem23-json-doc?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem23-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem23-json-doc?arch=i686&distro=amazonlinux-1 amazonlinux rubygem23-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem22-json?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem22-json < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem22-json?arch=i686&distro=amazonlinux-1 amazonlinux rubygem22-json < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem22-json-doc?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem22-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem22-json-doc?arch=i686&distro=amazonlinux-1 amazonlinux rubygem22-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem21-json?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem21-json < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem21-json?arch=i686&distro=amazonlinux-1 amazonlinux rubygem21-json < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem21-json-doc?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem21-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem21-json-doc?arch=i686&distro=amazonlinux-1 amazonlinux rubygem21-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-json?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-json < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-json?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-json < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-json-doc?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-json-doc?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem18-json?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem18-json < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem18-json?arch=i686&distro=amazonlinux-1 amazonlinux rubygem18-json < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem18-json-doc?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem18-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem18-json-doc?arch=i686&distro=amazonlinux-1 amazonlinux rubygem18-json-doc < 1.8.3-1.53.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem-json-debuginfo?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem-json-debuginfo < 1.8.3-1.53.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem-json-debuginfo?arch=i686&distro=amazonlinux-1 amazonlinux rubygem-json-debuginfo < 1.8.3-1.53.amzn1 amazonlinux-1 i686
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date