RHSA-2020:2462MediumCVSS 7.3

Red Hat Security Advisory: pcs security and bug fix update

Published
June 10, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2020-10663 →

📋 Description

CVE-2020-10663 — rubygem-json: Unsafe object creation vulnerability in JSON

🎯 Affected products18

  • Red Hat Enterprise Linux High Availability (v. 8)
  • Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.aarch64 as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.ppc64le as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.ppc64le as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.s390x as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.s390x as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.src as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.src as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.x86_64 as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-0:0.10.4-6.el8_2.1.x86_64 as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.aarch64 as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.ppc64le as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.ppc64le as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.s390x as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.s390x as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.x86_64 as a component of Red Hat Enterprise Linux High Availability (v. 8)
  • pcs-snmp-0:0.10.4-6.el8_2.1.x86_64 as a component of Red Hat Enterprise Linux Resilient Storage (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, do not supply untrusted user input and/or untrusted strings to the following method calls or utilize code libraries which do so: ``` JSON(user_input) JSON[user_input, nil] JSON.parse(user_input, nil) JSON::Parser.new(user_input).parse ``` Also note that JSON.load() should never be given input from unknown sources.

🔗 References (7)