PT-2020-6061 · Go · Gjson

Published 2020-12-15 · Updated 2021-06-23 · CVE-2020-35380

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GJSON versions prior to 1.6.4

Description The issue is related to insufficient input validation in the GJSON library, which can be exploited by attackers to cause a denial of service via crafted JSON. Maliciously crafted JSON objects can cause an out-of-bounds panic due to improper bounds checking. If the library is used to parse user input, this may be used as a denial of service vector.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the GJSON library when parsing user input to minimize the risk of exploitation. Avoid using the library with untrusted or unvalidated JSON data until the issue is resolved.

Exploit

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2021-02866

CVE-2020-35380

GHSA-W942-GW6M-P62C

GO-2021-0059

Affected Products

Gjson

References · 15

• 🔥 https://github.com/tidwall/gjson/issues/192 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35380 · Security Note
• https://osv.dev/vulnerability/GHSA-w942-gw6m-p62c · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02866 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-35380 · Security Note
• https://osv.dev/vulnerability/GO-2021-0059 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35380 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35380 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35380 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35380 · Vendor Advisory
• https://github.com/tidwall/gjson/commit/f0ee9ebde4b619767ae4ac03e8e42addb530f6bc · Note
• https://github.com/tidwall/gjson · Note
• https://pkg.go.dev/vuln/GO-2021-0059 · Note
• https://t.me/cibsecurity/20884 · Telegram Post