CVE-2020-10663: 
Ruby vulnerability analysis and mitigation

The JSON gem through version 2.2.0 for Ruby, as used in Ruby versions 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, contains an Unsafe Object Creation Vulnerability (CVE-2020-10663). This vulnerability is similar to CVE-2013-0269 but does not rely on poor garbage-collection behavior within Ruby (MITRE, Ruby Lang).

The vulnerability occurs when parsing certain JSON documents, where the json gem can be coerced into creating arbitrary objects within the interpreter. The issue affects multiple parsing methods including JSON.parse(user_input), JSON(user_input), and JSON.parse(user_input, nil). While previous fixes addressed some parsing methods, they were incomplete in covering all vulnerable parsing styles (Ruby Lang). The vulnerability has been assigned a CVSS 3.1 base score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (Ubuntu).

The vulnerability can lead to creation of malicious objects within the interpreter, with effects that are application-dependent. While earlier versions of this vulnerability could be exploited for Denial of Service through creation of garbage-uncollectable Symbol objects, this specific attack vector is no longer valid as Symbol objects are now garbage-collectable. However, the ability to create arbitrary objects may still have severe security consequences depending on the application code (Ruby Lang).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Ubuntu).

Users are strongly recommended to update the json gem to version 2.3.0 or later. This can be done using the command 'gem update json'. For applications using bundler, add 'gem "json", ">= 2.3.0"' to the Gemfile. Multiple vendors have released patches, including Red Hat, Ubuntu, and Debian (Ruby Lang, Red Hat).