Denial of Service Vulnerability in cJSON Package - CVE-2019-1010239
Summary
CVE-2019-1010239: DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Affects cjson across 2 version ranges.
< 1.7.10-1
< be749d7efa7c9021da746e685bd6dec79f9dd99b
Fixed in 1.7.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cJSON is a lightweight JSON parser written in C, designed to be simple and easy to use. It allows developers to parse, generate, and manipulate JSON data efficiently. The package is widely used in various applications for handling JSON data structures. However, cJSON version 1.7.8 has a vulnerability that can lead to a denial of service due to improper checks in its handling of JSON objects.
Vulnerability Detail
The vulnerability identified as CVE-2019-1010239 arises from the cJSON_GetObjectItemCaseSensitive() function in cJSON version 1.7.8. This function does not adequately check for unusual or exceptional conditions, which can result in a null dereference. An attacker can exploit this vulnerability by providing a crafted JSON file, leading to a denial of service as the application crashes when it attempts to dereference a null pointer. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.7.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cjsonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize JSON data before processing it with cJSON. This can help mitigate the risk of denial of service attacks by rejecting malformed JSON inputs.
Conclusion
The cJSON package version 1.7.8 is vulnerable to a denial of service attack due to improper checks in its handling of JSON objects. Upgrading to version 1.7.9 or later is essential to mitigate this risk. Users are encouraged to validate JSON inputs and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for cjson →
FAQ
CVE-2019-1010239 is a vulnerability in the cJSON package that can lead to a denial of service due to improper checks in the cJSON_GetObjectItemCaseSensitive() function.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. It allows you to monitor and alert for open-source vulnerabilities using just a manifest file.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires prompt attention.
As a temporary measure, implement input validation to sanitize JSON data before processing it with cJSON to reduce the risk of denial of service attacks.
You can find more information about cJSON and its functionalities on its GitHub repository at https://github.com/davegamble/cjson.
Related vulnerabilities
Recent vulnerabilities recorded for cjson.
