Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| Red Hat | Logging Subsystem for Red Hat OpenShift | — | |
| Red Hat | Red Hat 3scale API Management Platform 2 | — | |
| Red Hat | Red Hat AMQ Clients | — | |
| Red Hat | Red Hat Enterprise Linux 10 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8 | — | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions | |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | — | |
| Red Hat | Red Hat Hardened Images | all versions | |
| ruby | json | >= 2.14.0, < 2.15.2.1, >= 2.16.0, < 2.17.1.2, >= 2.18.0, < 2.19.2 | |
| ruby-lang | json | 2.14.0 – < 2.15.2.1 |
cpe:2.3:a:ruby-lang:json:*:*:*:*:*:ruby:*:* ≥ 2.14.0 < 2.15.2.1cpe:2.3:a:ruby-lang:json:*:*:*:*:*:ruby:*:* ≥ 2.16.0 < 2.17.1.2cpe:2.3:a:ruby-lang:json:*:*:*:*:*:ruby:*:* ≥ 2.18.0 < 2.19.2Two free tools, one defence: the Sensor catches whoever probes your server; Shield stops known attackers before they reach your site.
Install it and your daily API quota goes to 30,000 lookups — nothing to apply for.