QID 352370

<DIV ID="issue_overview"> the json gem through 2.2.0 for ruby, as used in ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an unsafe object creation vulnerability.
This is quite similar to cve-2013-0269 , but does not rely on poor garbage-collection behavior within ruby.
Specifically, use of json parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. (
cve-2020-10663 ) an issue was discovered in ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1.
Webrick, a simple http server bundled with ruby, had not checked the transfer-encoding header value rigorously.
An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an http request smuggling attack. (
cve-2020-25613 ) </DIV>

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.