PT-2021-23690 · Gjson+1 · Gjson+1

Cmdrgho · Published 2021-10-22 · Updated 2022-08-15 · CVE-2021-42836

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GJSON versions prior to 1.9.3

Description The issue allows a ReDoS (regular expression denial of service) attack. GJSON is a Go package that provides a fast and simple way to get values from a JSON document. A maliciously crafted path can cause Get and other query functions to consume excessive amounts of CPU and time.

Recommendations For versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted JSON input to minimize the risk of exploitation. Avoid using maliciously crafted paths in the Get and other query functions until the issue is resolved.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-697

CWE-1333

CWE-400

Related Identifiers

CVE-2021-42836

GHSA-C9GM-7RFJ-8W5H

GHSA-PPJ4-34RQ-V8J9

GO-2021-0265

Affected Products

Debian

Gjson

References · 19

• 🔥 https://github.com/tidwall/gjson/issues/236 · Exploit
• 🔥 https://github.com/tidwall/gjson/issues/237 · Exploit
• https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96 · Patch
• https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-42836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42836 · Security Note
• https://ubuntu.com/security/CVE-2021-42836 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-42836 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42248 · Security Note
• https://osv.dev/vulnerability/GO-2021-0265 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-42836 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-42836 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c9gm-7rfj-8w5h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppj4-34rq-v8j9 · Vendor Advisory