The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows…
Priority MEDIUM 48CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 6 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Why it matters now
EPSS 0.13911 96th percentileScored 2026-11-07
Fix Partial json (RubyGems): 1.5.5, 1.6.8, 1.7.7Red Hat: 5 advisoriesRed Hat: 6 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | json (RubyGems) | before 1.5.5 | 1.5.5 | Patch available | GHSA-x457-cw4h-hq5f |
| — | json (RubyGems) | 1.6.0 to before 1.6.8 | 1.6.8 | Patch available | GHSA-x457-cw4h-hq5f |
| — | json (RubyGems) | 1.7.0 to before 1.7.7 | 1.7.7 | Patch available | GHSA-x457-cw4h-hq5f |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- json (RubyGems) Vendor— Affected before 1.5.5 Fixed in 1.5.5 Patch available GHSA-x457-cw4h-hq5f
- json (RubyGems) Vendor— Affected 1.6.0 to before 1.6.8 Fixed in 1.6.8 Patch available GHSA-x457-cw4h-hq5f
- json (RubyGems) Vendor— Affected 1.7.0 to before 1.7.7 Fixed in 1.7.7 Patch available GHSA-x457-cw4h-hq5f
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubygems:json_gem:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.5.1:*:*:*:*:*:*:* | 1.5.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.5.2:*:*:*:*:*:*:* | 1.5.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.5.3:*:*:*:*:*:*:* | 1.5.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.5.4:*:*:*:*:*:*:* | 1.5.4 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.0:*:*:*:*:*:*:* | 1.6.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.1:*:*:*:*:*:*:* | 1.6.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.2:*:*:*:*:*:*:* | 1.6.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.3:*:*:*:*:*:*:* | 1.6.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.4:*:*:*:*:*:*:* | 1.6.4 | Vulnerable | rubygems |
- cpe:2.3:a:rubygems:json_gem:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.5.4:*:*:*:*:*:*:* Versions 1.5.4 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·rubygems
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubygems:json_gem:1.6.5:*:*:*:*:*:*:* | 1.6.5 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.6:*:*:*:*:*:*:* | 1.6.6 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.6.7:*:*:*:*:*:*:* | 1.6.7 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.0:*:*:*:*:*:*:* | 1.7.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.1:*:*:*:*:*:*:* | 1.7.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.2:*:*:*:*:*:*:* | 1.7.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.3:*:*:*:*:*:*:* | 1.7.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.4:*:*:*:*:*:*:* | 1.7.4 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.5:*:*:*:*:*:*:* | 1.7.5 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:json_gem:1.7.6:*:*:*:*:*:*:* | 1.7.6 | Vulnerable | rubygems |
- cpe:2.3:a:rubygems:json_gem:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:json_gem:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·rubygems
Remediation
- Fix · GHSA-x457-cw4h-hq5f json (RubyGems) Fixed in 1.5.5 Advisory →
- Fix · GHSA-x457-cw4h-hq5f json (RubyGems) Fixed in 1.6.8 Advisory →
- Fix · GHSA-x457-cw4h-hq5f json (RubyGems) Fixed in 1.7.7 Advisory →
Red Hat 5 advisories
- RHSA-2013:1185 Released 2013-08-29 · Red Hat rating ImportantRed Hat JBoss Fuse 6.0.0 patch 2
- Red Hat JBoss Fuse 6.0
- RHSA-2013:1147 Released 2013-08-08 · Red Hat rating ModerateRed Hat JBoss SOA Platform 5.3.1 update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2013:1028 Released 2013-07-09 · Red Hat rating ImportantFuse ESB Enterprise 7.1.0 update
- Fuse ESB Enterprise 7.1.0
Show 2 more Red Hat advisories
- RHSA-2013:0701 Released 2013-04-02 · Red Hat rating Moderateruby193-ruby, rubygem-json and rubygem-rdoc security update
- Red Hat OpenShift Enterprise Infrastructure ruby193-ruby-1.9.3.327-28.el6, ruby193-ruby-devel-1.9.3.327-28.el6, ruby193-ruby-doc-1.9.3.327-28.el6 +15
- Red Hat OpenShift Enterprise Node ruby193-ruby-1.9.3.327-28.el6, ruby193-ruby-devel-1.9.3.327-28.el6, ruby193-ruby-doc-1.9.3.327-28.el6 +13
- RHSA-2013:0686 Released 2013-03-26 · Red Hat rating ModerateSubscription Asset Manager 1.2.1 update
- Red Hat Subscription Asset Manager for RHEL 6 Server candlepin-0.7.24-1.el6_3, candlepin-devel-0.7.24-1.el6_3, candlepin-selinux-0.7.24-1.el6_3 +23
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise MRG 2 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2013:1028 |
| Red Hat JBoss Fuse 6.0 | Fixed | RHSA-2013:1185 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2013:1147 |
| Red Hat OpenShift Enterprise Infrastructure | Fixed | RHSA-2013:0701 |
| Red Hat OpenShift Enterprise Node | Fixed | RHSA-2013:0701 |
| Red Hat Subscription Asset Manager for RHEL 6 Server | Fixed | RHSA-2013:0686 |
Not affected: 1 product
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2013-0269
- 2026-10-03 Alias added: GHSA-x457-cw4h-hq5f
References
Advisory 12
- RHSA-2013:0701
- openSUSE-SU-2013:0603
- APPLE-SA-2013-10-22-5
- SSA:2013-075-01
- RHSA-2013:0686
- USN-1733-1
- SUSE-SU-2013:0609
- RHSA-2013:1028
- RHSA-2013:1147
- http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/
- SUSE-SU-2013:0647
- https://nvd.nist.gov/vuln/detail/CVE-2013-0269
Other 13
- http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
- [rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]
- 90074
- https://puppet.com/security/cve/cve-2013-0269
- [oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]
- http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection
- [oss-security] 20130211 Patch update for [CVE-2013-0269]
- https://github.com/flori/json
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2013-0269.yml
- https://web.archive.org/web/20130228082541/http://www.securityfocus.com/bid/57899
- https://web.archive.org/web/20160331131233/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
- https://web.archive.org/web/20160808163226/https://puppet.com/security/cve/cve-2013-0269
- http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released
Sources
- CVE-2013-0269 · CVE Program
- CVE-2013-0269 · NVD
- FIRST EPSS
- GHSA-x457-cw4h-hq5f · GitHub Advisory Database · CC BY 4.0
- CVE-2013-0269 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences