PT-2020-12279 · Buger · Buger Jsonparser

Wangcong15 · Published 2020-03-19 · Updated 2023-04-17 · CVE-2020-10675

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions buger jsonparser versions through 2019-12-04

Description The issue allows attackers to cause a denial of service (infinite loop) via a Delete call. This can occur when parsing malformed JSON that contains opening brackets but not closing brackets, potentially leading to an infinite loop if operating on untrusted user input.

Recommendations For versions through 2019-12-04, as a temporary workaround, consider restricting the use of the Delete call in the Library API until a patch is available. Avoid parsing untrusted user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2020-10675

GHSA-RMH2-65XW-9M6Q

GO-2021-0089

Affected Products

Buger Jsonparser

References · 19

• 🔥 https://github.com/buger/jsonparser/issues/188 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10675 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10675 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10675 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10675 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rmh2-65xw-9m6q · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0089 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10675 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10675 · Vendor Advisory
• https://github.com/buger/jsonparser · Note