rpms/rubygem-json
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add notes for CVE-2026-33210

Browse source
This commit is contained in:
Mamoru TASAKA 2026-03-20 14:42:56 +09:00
commit 2634d77dcd
1 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
CVE-2026-33210.info.txt Normal file
View file

@ -0,0 +1,23 @@
CVE-2026-33210:
* Upstream note
https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3
A format string injection vulnerability than that lead to denial of
service attacks or information disclosure,
when the allow_duplicate_key: false parsing option is used to parse
user supplied documents.
* Fedora side note
allow_duplicate_key is introduced in 2.13.0:
https://github.com/ruby/json/commit/06f00a42e8841cb768bf78514cf49b0d8cd63c27
https://github.com/ruby/json/commit/8d08494deebc406f69cfaa726c1b27f31bf6bb04
F45: fixed in rubygem-json-2.19.2-1.fc45
F44: fixed in rubygem-json-2.19.2-1.fc45
F43: fixed in rubygem-json-2.13.2-2.fc43
F42: unaffected (F42 uses rubygem-json-2.10.2-1.fc42)