UBUNTU-CVE-2020-25739

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.

References

Affected packages

Ubuntu:16.04:LTS / ruby-gon

Package

Name: ruby-gon
Purl: pkg:deb/ubuntu/ruby-gon@6.0.1-1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.2.3-2

6.*

6.0.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-gon",
            "binary_version": "6.0.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25739.json"

Ubuntu:18.04:LTS / ruby-gon

Package

Name: ruby-gon
Purl: pkg:deb/ubuntu/ruby-gon@6.1.0-1+deb9u1build0.18.04.1?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.1.0-1+deb9u1build0.18.04.1

Affected versions

6.*

6.1.0-1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "ruby-gon",
            "binary_version": "6.1.0-1+deb9u1build0.18.04.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25739.json"

Ubuntu:20.04:LTS / ruby-gon

Package

Name: ruby-gon
Purl: pkg:deb/ubuntu/ruby-gon@6.3.2-1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.2.1-1

6.3.2-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-gon",
            "binary_version": "6.3.2-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25739.json"