Bug 1035538 (CVE-2013-6401) - CVE-2013-6401 jansson: hash table collisions CPU usage DoS
Summary: CVE-2013-6401 jansson: hash table collisions CPU usage DoS
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2013-6401
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1063817 1063819 1063831
Blocks: 1035367 1035542
TreeView+ depends on / blocked
 
Reported: 2013-11-28 03:07 UTC by Murray McAllister
Modified: 2021-02-17 07:08 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-05-05 14:11:11 UTC


Attachments (Terms of Use)
CVE-2013-6401 patch (44.36 KB, patch)
2014-02-04 10:10 UTC, Murray McAllister
no flags Details | Diff

Description Murray McAllister 2013-11-28 03:07:06 UTC
It was found that the hashing implementation in Jansson, a library for encoding, decoding and manipulating JSON data, was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause an application using Jansson to use an excessive amount of CPU time by sending a crafted JSON document containing a large number of parameters whose names map to the same hash value.

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

Comment 6 Murray McAllister 2014-02-04 10:10:24 UTC
Created attachment 859025 [details]
CVE-2013-6401 patch

Comment 8 Murray McAllister 2014-02-11 13:30:31 UTC
(In reply to Murray McAllister from comment #7)
> Public now:
> https://github.com/akheron/jansson/commit/
> 8f80c2d83808150724d31793e6ade92749b1faa4

This one is also needed: https://github.com/akheron/jansson/commit/42016a35c8907e477be73b0b5d06cc09af231ee4

Comment 9 Murray McAllister 2014-02-11 13:33:00 UTC
Created jansson tracking bugs for this issue:

Affects: epel-6 [bug 1063819]

Comment 10 Murray McAllister 2014-02-11 13:37:14 UTC
Created jansson tracking bugs for this issue:

Affects: fedora-all [bug 1063817]

Comment 12 Jordi Massaguer Pla 2014-02-13 10:44:08 UTC
The first patch is very very long. According to github, 

19 changed files with 873 additions and 122 deletions

is this the minimal patch for fixing this CVE? Or does it include extra fixes??

thanks

Comment 13 Florian Weimer 2014-02-13 10:48:04 UTC
(In reply to Jordi Massaguer Pla from comment #12)
> The first patch is very very long. According to github, 
> 
> 19 changed files with 873 additions and 122 deletions
> 
> is this the minimal patch for fixing this CVE? Or does it include extra
> fixes??

No, it fixes just this bug.  It replaces the hashing function and adds random seeding.

Comment 14 Fedora Update System 2014-03-04 19:31:10 UTC
jansson-2.6-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Peter Robinson 2014-05-05 14:11:11 UTC
Closing as all dependent OS releases have fixes out


Note You need to log in before you can comment on or make changes to this bug.