Bug 1817733 (CVE-2020-10675) - CVE-2020-10675 golang-github-buger-jsonparser: infinite loop via a Delete call
Summary: CVE-2020-10675 golang-github-buger-jsonparser: infinite loop via a Delete call
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-10675
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1817734 1892514
Blocks: 1892306
TreeView+ depends on / blocked
 
Reported: 2020-03-26 20:26 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-06-07 14:44 UTC (History)
20 users (show)

Fixed In Version: jsonparser 1.0.0
Clone Of:
Environment:
Last Closed: 2021-04-05 17:35:15 UTC
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-03-26 20:26:35 UTC
The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.

Reference:
https://github.com/buger/jsonparser/issues/188

Comment 1 Guilherme de Almeida Suckevicz 2020-03-26 20:26:50 UTC
Created golang-github-buger-jsonparser tracking bugs for this issue:

Affects: fedora-all [bug 1817734]

Comment 2 Product Security DevOps Team 2020-03-26 22:31:50 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Comment 3 Doran Moppert 2020-10-29 01:54:22 UTC
This vulnerability can be exploited to cause an infinite loop in jsonparser if it is used to parse json data from an untrusted source.

Comment 7 Mark Cooper 2020-10-30 06:39:43 UTC
The following OpenShift 4 containers have indicators to github.com/buger/jsonparser:
    - openshift4/file-integrity-rhel8-operator
    - openshift4/cnf-tests-rhel8
    - openshift4/ose-container-networking-plugins-rhel8

However, the buger/jsonparser is a transient dependency from containernetworking/plugins:
$ go mod graph | grep buger/jsonparser
github.com/containernetworking/plugins.2 github.com/buger/jsonparser.0-20180808090653-f4dd9f5a6b44 

The repo github.com/containernetworking/plugins only includes github.com/buger when compiling on Windows:
:~/plugins$  go list -deps ./...  | grep buger/jsonparser
:~/plugins$

:~/plugins$ GOOS=windows go list -deps ./...  | grep buger/jsonparser
github.com/buger/jsonparser 

The associated containers only build on linux and are not affected. That and the go compiler does not include containernetworking/plugins in the build. 

It has been left on the affects however to prevent confusion as it can appear in the go.sum file.

Comment 9 Przemyslaw Roguski 2020-10-30 11:58:05 UTC
External References:

https://github.com/buger/jsonparser/issues/188

Comment 10 Stoyan Nikolov 2020-12-11 09:13:16 UTC
Statement:

The OpenShift Container Platform 4 (OCP)  containers file-integrity-rhel8-operator, cnf-tests-rhel8 and ose-container-networking-plugins-rhel8 do have some references to github.com/buger/jsonparser, mainly in their go.sum files. However, it is not included in the final go build. It is also a dependency of the dependency github.com/containernetworking/plugins which only includes buger/jsonparse when compiling for Windows, which these containers do not. Hence the associated containers have been marked not affected.

OpenShift Virtualization cnv-containernetworking-plugins container depends on  github.com/buger/jsonparser only when built for Windows, which it is not, thus it is not affected. Other OpenshiftVirtualization containers (virt-api, virt-controller, virt-handler, virt-launcher, virt-operator, kubernetes-nmstate-handler, ovs-cni-marker, ovs-cni-plugin, kubemacpool, hyperconverged-cluster-operator) have references to github.com/buger/jsonparser, however it is not included in the final go build.

Comment 11 Product Security DevOps Team 2021-04-05 17:35:15 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10675


Note You need to log in before you can comment on or make changes to this bug.