PT-2019-5668 · Dave Gamble · Cjson

Published 2019-07-19 · Updated 2025-07-22 · CVE-2019-1010239

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions DaveGamble/cJSON versions 1.7.8

Description The issue is related to an improper check for unusual or exceptional conditions, which can lead to a null dereference. This can cause a denial of service when a crafted JSON file is used as an attack vector. The vulnerable component is the cJSON GetObjectItemCaseSensitive() function.

Recommendations For DaveGamble/cJSON version 1.7.8, update to version 1.7.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the cJSON GetObjectItemCaseSensitive() function until a patch is available. Avoid using crafted JSON files that could exploit this issue until the update is applied.

Exploit

Fix

DoS

NULL Pointer Dereference

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-476

CWE-754

Related Identifiers

BDU:2020-04950

CVE-2019-1010239

Affected Products

Cjson

References · 10

• 🔥 https://github.com/DaveGamble/cJSON/issues/315 · Exploit
• https://github.com/DaveGamble/cJSON/commit/be749d7efa7c9021da746e685bd6dec79f9dd99b · Patch
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010239 · Security Note
• https://bdu.fstec.ru/vul/2020-04950 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-1010239 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010239 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010239 · Vendor Advisory
• https://t.me/cveNotify/129866 · Telegram Post
• https://t.me/cvenotify/129866 · Telegram Post