Bug 1835253 (CVE-2020-12762)
| Summary: | CVE-2020-12762 json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adudiak, alakatos, besser82, echen, igor.raits, jeffrey.lau, jiri, nweather, rsroka, stcannon, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | json-c-0.14-3.fc33, libfastjson 0.99.9.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in json-c. In printbuf_memappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-09 17:51:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1835255, 1835624, 1835625, 1835626, 1836219, 1836220, 2203170, 2203171, 2203172 | ||
| Bug Blocks: | 1835256 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-05-13 13:50:32 UTC
Created json-c tracking bugs for this issue: Affects: fedora-all [bug 1835255] Upstream patch: https://github.com/json-c/json-c/pull/592/commits/d07b91014986900a3a75f306d302e13e005e9d67 Statement: This is essentially a integer overflow in the 'size' variable caused by large data input. In most systems its a signed integer overflow and results in out of bounds buffer write on the heap. However the impact is greatly reduced because such an attack is only possible if the application compiled with json-c is designed to accept untrusted large json files. Also the attack vector in this case as considered as local in most practical cases. Mitigation: Since this flaw is triggered by untrusted large json files. If any applications linked against json-c is used ensure that the application does not accept large json files. (or untrusted ones wherever possible) Can you please open a tracking bug for the `json-c12` package in EPEL {6,7}, too?
Rawhide already ships the fix with NVR `json-c-0.14-3.fc33`. Updates for Fedora 3{2,1,0} have been submitted.
Created json-c12 tracking bugs for this issue: Affects: epel-6 [bug 1836219] Affects: epel-7 [bug 1836220] Updates for epel-{6,7} have been submitted.
You can find fully working backports of the needed fixes here: * json-c-0.14: https://github.com/json-c/json-c/pull/608 * json-c-0.13.x: https://github.com/json-c/json-c/pull/607 * json-c-0.12.x: https://github.com/json-c/json-c/pull/611 * json-c-0.11: https://github.com/json-c/json-c/pull/612 * json-c-0.10: https://github.com/json-c/json-c/pull/613 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12762 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4382 https://access.redhat.com/errata/RHSA-2021:4382 CVE-2020-12762 also affects libfastjson the same way it affects json-c. https://github.com/rsyslog/libfastjson/issues/161 https://github.com/rsyslog/libfastjson/pull/166 https://github.com/rsyslog/libfastjson/commit/f51fcd59a8bbeb60eaf8ae0e398556be2fa3317a (0.99.9.1) Libfastjson is a fork from json-c, but both are different repo. Also, as per https://github.com/rsyslog/libfastjson/issues/161#issuecomment-1463424648, the vulnerable code is not substantially different - the affected code is still the same in both. So based on the CVE assignment rules, it's better to go with existing CVE-2020-12762, instead of new one for libfastjson. Created libfastjson tracking bugs for this issue: Affects: fedora-all [bug 2203170] This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6431 https://access.redhat.com/errata/RHSA-2023:6431 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6976 https://access.redhat.com/errata/RHSA-2023:6976 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0411 https://access.redhat.com/errata/RHSA-2024:0411 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:0573 https://access.redhat.com/errata/RHSA-2024:0573 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:1086 https://access.redhat.com/errata/RHSA-2024:1086 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2024:1154 https://access.redhat.com/errata/RHSA-2024:1154 |