Denial of Service Vulnerability in Buger JSONParser Package
Summary
CVE-2020-10675: The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call. Affects golang-github-buger-jsonparser across 2 version ranges.
< 0.0~git20200322.0.f7e751e-1
< 5754b3eaeae78aeca49528d2ab980c0f26ca707c
Fixed in 0.0~git20200322.0.f7e751e-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Buger JSONParser is a Go library designed for fast and efficient parsing of JSON data. It is widely used in various applications due to its performance and ease of use. However, it has been identified to have a vulnerability that allows attackers to exploit the library, leading to a denial of service condition.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10675, arises from an infinite loop that can be triggered by a Delete call within the Library API of the Buger JSONParser. This flaw allows attackers to cause a denial of service, potentially leading to application crashes or unresponsiveness. The issue was introduced in versions prior to the fix and affects multiple Debian ecosystems, including Debian 11, 12, and 13.
How To Fix
Minimum fixed version
0.0~git20200322.0.f7e751e-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-buger-jsonparserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to prevent malicious data from being processed by the JSONParser. This can help mitigate the risk of triggering the infinite loop.
Conclusion
The CVE-2020-10675 vulnerability in the Buger JSONParser poses a significant risk by allowing denial of service attacks through an infinite loop. It is crucial for users to update their packages to the latest version to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for golang-github-buger-jsonparser →
FAQ
CVE-2020-10675 is a vulnerability in the Buger JSONParser that allows attackers to cause a denial of service through an infinite loop triggered by a Delete call.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-10675 is 7.5, indicating a high severity level.
If you cannot update the package, consider implementing input validation to prevent the processing of potentially malicious data.
More information can be found on the official CVE database and the GitHub repository for the Buger JSONParser.
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-buger-jsonparser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
