Hide Forgot
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Reference: https://github.com/json-c/json-c/pull/592
Created json-c tracking bugs for this issue: Affects: fedora-all [bug 1835255]
Upstream patch: https://github.com/json-c/json-c/pull/592/commits/d07b91014986900a3a75f306d302e13e005e9d67
Statement: This is essentially a integer overflow in the 'size' variable caused by large data input. In most systems its a signed integer overflow and results in out of bounds buffer write on the heap. However the impact is greatly reduced because such an attack is only possible if the application compiled with json-c is designed to accept untrusted large json files. Also the attack vector in this case as considered as local in most practical cases.
Mitigation: Since this flaw is triggered by untrusted large json files. If any applications linked against json-c is used ensure that the application does not accept large json files. (or untrusted ones wherever possible)
Can you please open a tracking bug for the `json-c12` package in EPEL {6,7}, too?
Rawhide already ships the fix with NVR `json-c-0.14-3.fc33`. Updates for Fedora 3{2,1,0} have been submitted.
Created json-c12 tracking bugs for this issue: Affects: epel-6 [bug 1836219] Affects: epel-7 [bug 1836220]
Updates for epel-{6,7} have been submitted.
You can find fully working backports of the needed fixes here: * json-c-0.14: https://github.com/json-c/json-c/pull/608 * json-c-0.13.x: https://github.com/json-c/json-c/pull/607 * json-c-0.12.x: https://github.com/json-c/json-c/pull/611 * json-c-0.11: https://github.com/json-c/json-c/pull/612 * json-c-0.10: https://github.com/json-c/json-c/pull/613