json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Reference: https://github.com/json-c/json-c/pull/592
Created json-c tracking bugs for this issue: Affects: fedora-all [bug 1835255]
Upstream patch: https://github.com/json-c/json-c/pull/592/commits/d07b91014986900a3a75f306d302e13e005e9d67
Statement: This is essentially a integer overflow in the 'size' variable caused by large data input. In most systems its a signed integer overflow and results in out of bounds buffer write on the heap. However the impact is greatly reduced because such an attack is only possible if the application compiled with json-c is designed to accept untrusted large json files. Also the attack vector in this case as considered as local in most practical cases.
Mitigation: Since this flaw is triggered by untrusted large json files. If any applications linked against json-c is used ensure that the application does not accept large json files. (or untrusted ones wherever possible)
Can you please open a tracking bug for the `json-c12` package in EPEL {6,7}, too?
Rawhide already ships the fix with NVR `json-c-0.14-3.fc33`. Updates for Fedora 3{2,1,0} have been submitted.
Created json-c12 tracking bugs for this issue: Affects: epel-6 [bug 1836219] Affects: epel-7 [bug 1836220]
Updates for epel-{6,7} have been submitted.
You can find fully working backports of the needed fixes here: * json-c-0.14: https://github.com/json-c/json-c/pull/608 * json-c-0.13.x: https://github.com/json-c/json-c/pull/607 * json-c-0.12.x: https://github.com/json-c/json-c/pull/611 * json-c-0.11: https://github.com/json-c/json-c/pull/612 * json-c-0.10: https://github.com/json-c/json-c/pull/613
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12762
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4382 https://access.redhat.com/errata/RHSA-2021:4382
CVE-2020-12762 also affects libfastjson the same way it affects json-c. https://github.com/rsyslog/libfastjson/issues/161 https://github.com/rsyslog/libfastjson/pull/166 https://github.com/rsyslog/libfastjson/commit/f51fcd59a8bbeb60eaf8ae0e398556be2fa3317a (0.99.9.1) Libfastjson is a fork from json-c, but both are different repo. Also, as per https://github.com/rsyslog/libfastjson/issues/161#issuecomment-1463424648, the vulnerable code is not substantially different - the affected code is still the same in both. So based on the CVE assignment rules, it's better to go with existing CVE-2020-12762, instead of new one for libfastjson.
Created libfastjson tracking bugs for this issue: Affects: fedora-all [bug 2203170]
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6431 https://access.redhat.com/errata/RHSA-2023:6431
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6976 https://access.redhat.com/errata/RHSA-2023:6976
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0411 https://access.redhat.com/errata/RHSA-2024:0411
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:0573 https://access.redhat.com/errata/RHSA-2024:0573
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:1086 https://access.redhat.com/errata/RHSA-2024:1086
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2024:1154 https://access.redhat.com/errata/RHSA-2024:1154