Denial of Service Vulnerability in GJSON Package (CVE-2020-36066)
Summary
CVE-2020-36066: GJSON. Affects golang-github-tidwall-gjson across 2 version ranges.
< 1.6.7-1
< 9f58baa7a613f89dfdc764c39e47fd3a15606153
Fixed in 1.6.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GJSON is a Go library designed for fast JSON parsing. It allows developers to easily extract values from JSON documents with a simple syntax. The library is widely used in various applications due to its performance and ease of use. However, it has a vulnerability that can be exploited to cause a denial of service, impacting applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2020-36066 affects GJSON versions prior to 1.6.5. Attackers can exploit this vulnerability by sending crafted JSON data that can lead to a denial of service. This can result in the application becoming unresponsive or crashing, affecting the availability of services that depend on GJSON for JSON parsing. The vulnerability arises from insufficient validation of JSON input, allowing maliciously crafted data to overwhelm the parser.
How To Fix
Minimum fixed version
1.6.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-tidwall-gjsonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize JSON data before processing it with GJSON. This can help mitigate the risk of denial of service attacks. For example, you can limit the size of the JSON input or check for specific patterns that indicate malicious content.
Conclusion
CVE-2020-36066 is a significant vulnerability in the GJSON package that can lead to denial of service attacks. It is crucial for developers using this package to update to version 1.6.7 or later to mitigate the risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for golang-github-tidwall-gjson →
FAQ
CVE-2020-36066 is a vulnerability in the GJSON package that allows attackers to cause a denial of service through crafted JSON input.
GJSON versions prior to 1.6.5 are affected by this vulnerability.
Exploiting this vulnerability can lead to denial of service, causing applications to become unresponsive or crash.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2020-36066 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-tidwall-gjson.
