Описание
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
A flaw was found in the cJSON library. On 32-bit platforms, a specially crafted JSON string can cause an integer overflow in the print_string_ptr() function. This vulnerability can lead to a heap buffer overflow, which an attacker could exploit to achieve remote code execution, disclose sensitive information, or cause a denial of service.
Отчет
This flaw is an integer overflow in the print_string_ptr() function of the cJSON library. A 32-bit size_t counter used to track escape characters can wrap around when a JSON string contains approximately 858,993,460 or more control characters, causing an undersized heap buffer to be allocated and subsequently overflowed when the JSON is printed. This issue does not affect the versions of cJSON, or of components that vendor/bundle it (such as rpm-ostree), as shipped with Red Hat Enterprise Linux, Red Hat Satellite, or OpenShift Container Platform. None of these products build or run cJSON, or components embedding it, as 32-bit (i686) binaries: Red Hat Enterprise Linux 7 and later do not support direct installation on or execution as a 32-bit x86 process, the RHEL 8/9 multilib compatibility layer does not include general application libraries such as cJSON, and RHEL 10 removed multilib support entirely. Since the underlying size_t overflow this flaw depends on only manifests on a 32-bit build, the vulnerable condition is not reachable on any architecture these products ship or run on. Additionally, the CVE Numbering Authority (CERT.PL) was unable to reach the cJSON project maintainer during disclosure, and this issue has only been confirmed in cJSON version 1.7.19; no official upstream fix is currently available.
Меры по смягчению последствий
No mitigation is required for Red Hat Enterprise Linux, Red Hat Satellite, or OpenShift Container Platform, as these products are not affected due to their exclusively 64-bit architecture support. No upstream fix is currently available for other affected configurations (for example, cJSON as built for 32-bit architectures in Fedora). As a general precaution, applications using cJSON on a 32-bit platform should avoid processing untrusted JSON input containing very large numbers of control characters within a single string value.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | rpm-ostree | Not affected | ||
| Red Hat Hardened Images | chunkah | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rpm-ostree | Not affected | ||
| Red Hat Satellite 6 | cjson | Not affected | ||
| Red Hat Satellite 6 | satellite:el8/cjson | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
cJSON library is vulnerable to an integer overflow in the print_string ...
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
EPSS
6.8 Medium
CVSS3