CVE-2021-32292
json-c: stack-buffer-overflow in parseit() in json_parse.c
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, CBL-Mariner, Photon OS. Más baja según Ubuntu (media).
Descripción
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 2.0 | json-c | 0:0.15-2.cm2 |
| Photon OS 4.0 | json-c, json-c-devel | 0.15-4.ph4 |
| conan::GitLab Advisory Database Community | json-c | 0.16 |
| debian 11 | json-c | 0.15-2+deb11u1 |
| debian 12 | json-c | 0.16-1 |
| debian 13 | json-c | 0.16-1 |
| debian 14 | json-c | 0.16-1 |
| echo | json-c | 0.16-1 |
| ubuntu 22.04 | json-c | 0.15-3~ubuntu1.22.04.2 |
Mostrar las 10 entradas de 9 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 2.0 | json-c | 0:0.15-2.cm2 |
| Photon OS 4.0 | json-c | 0.15-4.ph4 |
| Photon OS 4.0 | json-c-devel | 0.15-4.ph4 |
| conan::GitLab Advisory Database Community | json-c | 0.16 |
| debian 11 | json-c | 0.15-2+deb11u1 |
| debian 12 | json-c | 0.16-1 |
| debian 13 | json-c | 0.16-1 |
| debian 14 | json-c | 0.16-1 |
| echo | json-c | 0.16-1 |
| ubuntu 22.04 | json-c | 0.15-3~ubuntu1.22.04.2 |
Referencias
- https://access.redhat.com/security/cve/CVE-2021-32292
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://github.com/json-c/json-c/commit/4e9e44e5258dee7654f74948b0dd5da39c28beec
- https://github.com/json-c/json-c/issues/654
- https://github.com/json-c/json-c/issues/654#issuecomment-670437005
- https://nvd.nist.gov/vuln/detail/CVE-2021-32292
- https://security.netapp.com/advisory/ntap-20230929-0010/
- https://ubuntu.com/security/notices/USN-6310-1