Improper input validation in Apple macOS
CVE-2020-10663
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.068 (93.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 93.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.068 · newest: 0.068 · change: 0.000
Affected products
- Apple macOS — versions 11.0.1
- JSON Project
- Ruby-Lang Ruby
- Debian Linux — versions 8.0, 10.0
- Fedoraproject Fedora — versions 30, 31
- openSUSE Leap — versions 15.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ (Vendor Advisory)
- lists.debian.org/debian-lts-announce/2020/04/msg00030.html (mailing-list, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.debian.org/security/2020/dsa-4721 (vendor-advisory, Third Party Advisory)
- lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaa… (mailing-list)
- lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b… (mailing-list)
- lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562… (mailing-list)
Frequently asked questions
- What is CVE-2020-10663?
- CVE-2020-10663 is a high-severity vulnerability in Apple macOS, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2020-04-28.
- How severe is CVE-2020-10663?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2020-10663 known to be exploited?
- 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.