Skip to content
OpenAdvisories
High USN-4882-1 3 CVEs

ruby2.3, ruby2.5, ruby2.7 vulnerabilities

Published Mar 18, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the Ruby JSON gem incorrectly handled certain JSON
files. If a user or automated system were tricked into parsing a specially
crafted JSON file, a remote attacker could use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-10663)

It was discovered that Ruby incorrectly handled certain socket memory
operations. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-10933)

It was discovered that Ruby incorrectly handled certain transfer-encoding
headers when using Webrick. A remote attacker could possibly use this issue
to bypass a reverse proxy. (CVE-2020-25613)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS ruby2.3 2.3.1-2~ubuntu16.04.15
Ubuntu · 18.04 LTS 18.04:LTS ruby2.5 2.5.1-1ubuntu1.8
Ubuntu · 20.04 LTS 20.04:LTS ruby2.7 2.7.0-5ubuntu1.3

Vulnerabilities 3

  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2020-10933

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

    ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2020-10663
  • report
    https://ubuntu.com/security/CVE-2020-10933
  • report
    https://ubuntu.com/security/CVE-2020-25613