CVE-2013-0269
NoneCVSS
—
EPSS
13.9%
Published
Feb 13, 2013
CISA due date
—
The record
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | json | 0 | 1.5.5 |
| RubyGems | json | 1.6.0 | 1.6.8 |
| RubyGems | json | 1.7.0 | 1.7.7 |
| Debian:11 | ruby-json | 0 | 1.7.3-3 |
| Debian:12 | ruby-json | 0 | 1.7.3-3 |
| Debian:13 | ruby-json | 0 | 1.7.3-3 |
| Debian:6.0 | libjson-ruby | 0 | 1.1.9-1+deb6u1 |
| Debian:6.0 | ruby1.9.1 | 0 | 1.9.2.0-2+deb6u5 |
| Red Hat:openshift:1::el6 | ruby193-ruby | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-ruby-debuginfo | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-ruby-devel | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-ruby-doc | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-ruby-irb | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-ruby-libs | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-ruby-tcltk | 0 | 0:1.9.3.327-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygem-bigdecimal | 0 | 0:1.1.0-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygem-io-console | 0 | 0:0.3-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygem-json | 0 | 0:1.5.4-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygem-minitest | 0 | 0:2.5.1-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygem-rake | 0 | 0:0.9.2.2-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygem-rdoc | 0 | 0:3.9.4-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygems | 0 | 0:1.8.23-28.el6 |
| Red Hat:openshift:1::el6 | ruby193-rubygems-devel | 0 | 0:1.8.23-28.el6 |
| Red Hat:openshift:1::el6 | rubygem-json | 0 | 0:1.7.3-2.el6op |
| Red Hat:openshift:1::el6 | rubygem-json-debuginfo | 0 | 0:1.7.3-2.el6op |
| Red Hat:openshift:1::el6 | rubygem-json-doc | 0 | 0:1.7.3-2.el6op |
| Red Hat:openshift:1::el6 | rubygem-rdoc | 0 | 0:3.8-9.el6op |
| Red Hat:openshift:1::el6 | rubygem-rdoc-doc | 0 | 0:3.8-9.el6op |
| Ubuntu:14.04:LTS | ruby-json | 0 | 1.8.0-1 |
| gem | json | 1.6.0 | 1.6.8 |
| gem | json | 1.7.0 | 1.7.7 |
| maven | org.jruby/jruby | 1.7.1 | 1.7.3 |
Related vulnerabilities
- CVE-2009-5147 DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before… Also affects ruby1.9.1
- CVE-2014-8090 The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel… Also affects ruby1.9.1
- CVE-2014-4975 Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x… Also affects ruby1.9.1
- CVE-2013-4164 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… Also affects ruby1.9.1
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20