Bug 1035538 (CVE-2013-6401)

Summary: CVE-2013-6401 jansson: hash table collisions CPU usage DoS
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fweimer, jmassaguerpla, jpirko, pbrobinson, pfrields, security-response-team, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-05-05 14:11:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1063817, 1063819, 1063831    
Bug Blocks: 1035367, 1035542    
Attachments:
Description Flags
CVE-2013-6401 patch none

Description Murray McAllister 2013-11-28 03:07:06 UTC 
It was found that the hashing implementation in Jansson, a library for encoding, decoding and manipulating JSON data, was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause an application using Jansson to use an excessive amount of CPU time by sending a crafted JSON document containing a large number of parameters whose names map to the same hash value.

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Comment 6 Murray McAllister 2014-02-04 10:10:24 UTC 
Created attachment 859025 [details]
CVE-2013-6401 patch
Comment 7 Murray McAllister 2014-02-11 13:21:57 UTC 
Public now: https://github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4
Comment 8 Murray McAllister 2014-02-11 13:30:31 UTC 
(In reply to Murray McAllister from comment #7)
> Public now:
> https://github.com/akheron/jansson/commit/
> 8f80c2d83808150724d31793e6ade92749b1faa4

This one is also needed: https://github.com/akheron/jansson/commit/42016a35c8907e477be73b0b5d06cc09af231ee4
Comment 9 Murray McAllister 2014-02-11 13:33:00 UTC 
Created jansson tracking bugs for this issue:

Affects: epel-6 [bug 1063819]
Comment 10 Murray McAllister 2014-02-11 13:37:14 UTC 
Created jansson tracking bugs for this issue:

Affects: fedora-all [bug 1063817]
Comment 12 Jordi Massaguer Pla 2014-02-13 10:44:08 UTC 
The first patch is very very long. According to github, 

19 changed files with 873 additions and 122 deletions

is this the minimal patch for fixing this CVE? Or does it include extra fixes??

thanks
Comment 13 Florian Weimer 2014-02-13 10:48:04 UTC 
(In reply to Jordi Massaguer Pla from comment #12)
> The first patch is very very long. According to github, 
> 
> 19 changed files with 873 additions and 122 deletions
> 
> is this the minimal patch for fixing this CVE? Or does it include extra
> fixes??

No, it fixes just this bug.  It replaces the hashing function and adds random seeding.
Comment 14 Fedora Update System 2014-03-04 19:31:10 UTC 
jansson-2.6-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Peter Robinson 2014-05-05 14:11:11 UTC 
Closing as all dependent OS releases have fixes out