Description
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | ruby193-ruby +5 | 1.9.3.327-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-bigdecimal | 1.1.0-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-io-console | 0.3-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-json | 1.5.4-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-minitest | 2.5.1-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-rake | 0.9.2.2-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-rdoc | 3.9.4-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygems +1 | 1.8.23-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | rubygem-json +1 | 1.7.3-2.el6op | RHSA-2013:0701 |
| Red Hat OpenShift 1 | rubygem-rdoc +1 | 3.8-9.el6op | RHSA-2013:0701 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
heroku/heroku-CVE-2013-0269 ★ 2 · Feb 11, 2013
Inspect all of your Heroku apps for vulnerable versions of the JSON gem
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | json | < 1.5.5 | 1.5.5 | GHSA-x457-cw4h-hq5f |
| RubyGems | json | >= 1.6.0, < 1.6.8 | 1.6.8 | GHSA-x457-cw4h-hq5f |
| RubyGems | json | >= 1.7.0, < 1.7.7 | 1.7.7 | GHSA-x457-cw4h-hq5f |
Advisories 4
- RHSA-2013:0701 Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update Red Hat Security Advisories (RHSA) · Apr 28, 2026
- DLA-263-1 ruby1.9.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-215-1 libjson-ruby - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1601 Red Hat JBoss Enterprise SOA Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
References
- RHSA-2013:0701 vendor-advisory
- openSUSE-SU-2013:0603 vendor-advisory
- APPLE-SA-2013-10-22-5 vendor-advisory
- SSA:2013-075-01 vendor-advisory
- 52774 third-party-advisory
- http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
- [rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] mailing-list
- 90074 vdb-entry
- https://puppet.com/security/cve/cve-2013-0269
- 52902 third-party-advisory
- RHSA-2013:0686 vendor-advisory
- 57899 vdb-entry
- [oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] mailing-list
- http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection
- [oss-security] 20130211 Patch update for [CVE-2013-0269] mailing-list
- USN-1733-1 vendor-advisory
- SUSE-SU-2013:0609 vendor-advisory
- RHSA-2013:1028 vendor-advisory
- json-ruby-security-bypass(82010) vdb-entry
- RHSA-2013:1147 vendor-advisory
- http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/
- 52075 third-party-advisory
- SUSE-SU-2013:0647 vendor-advisory