From 2634d77dcd9592681b25f67f3a49dca10504de5c Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Fri, 20 Mar 2026 14:42:56 +0900 Subject: [PATCH] Add notes for CVE-2026-33210 --- CVE-2026-33210.info.txt | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 CVE-2026-33210.info.txt diff --git a/CVE-2026-33210.info.txt b/CVE-2026-33210.info.txt new file mode 100644 index 0000000..482ba87 --- /dev/null +++ b/CVE-2026-33210.info.txt @@ -0,0 +1,23 @@ +CVE-2026-33210: + +* Upstream note + +https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3 + +A format string injection vulnerability than that lead to denial of +service attacks or information disclosure, +when the allow_duplicate_key: false parsing option is used to parse +user supplied documents. + +* Fedora side note + +allow_duplicate_key is introduced in 2.13.0: + +https://github.com/ruby/json/commit/06f00a42e8841cb768bf78514cf49b0d8cd63c27 +https://github.com/ruby/json/commit/8d08494deebc406f69cfaa726c1b27f31bf6bb04 + +F45: fixed in rubygem-json-2.19.2-1.fc45 +F44: fixed in rubygem-json-2.19.2-1.fc45 +F43: fixed in rubygem-json-2.13.2-2.fc43 +F42: unaffected (F42 uses rubygem-json-2.10.2-1.fc42) +