Package Instance

Ruby JSON has a format string injection vulnerability
### Impact

A format string injection vulnerability than that lead to denial of
service attacks or information disclosure, when the `allow_duplicate_key:
false` parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it,
you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false`
parsing option.

Unsafe Object Creation Vulnerability in JSON (Additional fix)
When parsing certain JSON documents, the json gem (including the one bundled
with Ruby) can be coerced into creating arbitrary objects in the target
system.

This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
addressed `JSON.parse(user_input)`, but didn’t address some other styles of JSON
parsing including `JSON(user_input)` and `JSON.parse(user_input, nil)`.

See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
Denial of Service by creating many garbage-uncollectable Symbol objects, but
this kind of attack is no longer valid because Symbol objects are now
garbage-collectable. However, creating arbitrary objects may cause severe
security consequences depending upon the application code.

Please update the json gem to version 2.3.0 or later. You can use `gem update
json` to update it. If you are using bundler, please add `gem "json", ">= 2.3.0"`
to your Gemfile

Denial of Service and SQL Injection
This package allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka.