Denial of Service Vulnerability in golang-github-buger-jsonparser Package
Summary
DEBIAN-CVE-2020-35381: jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call. Affects golang-github-buger-jsonparser versions < 1.1.1-1. Fixed in 1.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang-github-buger-jsonparser package is a JSON parser for Go that is designed to efficiently handle JSON data. It is widely used in applications that require fast and reliable JSON processing. However, versions prior to 1.1.1-1 are vulnerable to a denial of service attack, which can lead to application crashes and service interruptions.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2020-35381 allows attackers to exploit jsonparser version 1.0.0 by sending a specially crafted GET request. This request can trigger a panic in the application due to a runtime error caused by slice bounds being out of range. The consequence of this vulnerability is a denial of service, where the application becomes unresponsive or crashes, affecting the availability of the service.
How To Fix
Minimum fixed version
1.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-buger-jsonparserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to implement input validation on the GET requests to ensure that they do not trigger the panic condition. This can involve checking the size of the input data before processing it.
Conclusion
The golang-github-buger-jsonparser package has a critical vulnerability that can lead to denial of service. It is crucial to update to the patched version to ensure the security and availability of applications using this package. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for golang-github-buger-jsonparser →
FAQ
The vulnerability allows for a denial of service attack due to a panic triggered by out-of-range slice bounds in version 1.0.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The primary impact is a denial of service, which can lead to application crashes and unavailability of services.
Yes, the patch is available in version 1.1.1-1 of the golang-github-buger-jsonparser package.
Implement input validation on the GET requests as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-buger-jsonparser.
