PT-2021-23565 · Gjson · Gjson

Published 2021-10-25 · Updated 2024-05-02 · CVE-2021-42248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GJSON versions 1.9.2 and earlier GJSON version 1.9.3 is not affected, but versions prior to 1.9.3 are vulnerable, so the correct consolidation is: GJSON versions prior to 1.9.3

Description The issue allows attackers to cause a ReDoS (regular expression denial of service) attack via crafted JSON input. A maliciously crafted path can cause Get and other query functions to consume excessive amounts of CPU and time.

Recommendations For GJSON versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the input to the Get and other query functions to prevent excessive CPU and time consumption.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-697

CWE-1333

CWE-400

Related Identifiers

CVE-2021-42248

GHSA-C9GM-7RFJ-8W5H

GHSA-PPJ4-34RQ-V8J9

GO-2021-0265

GO-2022-0592

Affected Products

Gjson

References · 17

• 🔥 https://github.com/tidwall/gjson/issues/237 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42836 · Security Note
• https://osv.dev/vulnerability/GO-2022-0592 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-42248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-42248 · Security Note
• https://osv.dev/vulnerability/GO-2021-0265 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42248 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c9gm-7rfj-8w5h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppj4-34rq-v8j9 · Vendor Advisory
• https://github.com/tidwall/gjson/issues/236 · Note
• https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96 · Note
• https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944 · Note
• https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3 · Note
• https://github.com/tidwall/gjson · Note