PT-2014-3099 · Json-C+3 · Json-C+3

Florian Weimer · Published 2014-04-08 · Updated 2024-06-15 · CVE-2013-6371

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions json-c versions prior to 0.12

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by providing crafted JSON data that involves collisions, thus exploiting the hash functionality.

Recommendations For versions prior to 0.12, update to version 0.12 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2014-1691

ALT-PU-2019-4163

ALT-PU-2020-2322

ALT-PU-2023-6481

ALT-PU-2023-6841

CVE-2013-6371

MGASA-2014-0175

OPENSUSE-SU-2024:10013-1

OPENSUSE-SU-2024:10498-1

RHSA-2014:0703

RHSA-2014_0703

USN-2245-1

Affected Products

Alt Linux

Red Hat

Ubuntu

Json-C

References · 31

• https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015 · Patch
• https://ubuntu.com/security/CVE-2013-6370 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6371 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0175.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10498-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2245-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6371 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10013-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6371 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-6371 · Security Note
• https://ubuntu.com/security/CVE-2013-6371 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2245-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0175 · Vendor Advisory