Stack Exhaustion Vulnerability in jansson
Summary
DLA-471-1: jansson - security update. Affects jansson versions < 2.3.1-2+deb7u1. Fixed in 2.3.1-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jansson is a C library used for encoding, decoding, and manipulating JSON data. It provides functionality for working with JSON files and is commonly used in various applications. However, a vulnerability has been discovered in Jansson that could lead to a crash due to stack exhaustion while parsing a JSON file. This vulnerability arises from an unlimited parsing depth when handling JSON arrays.
Vulnerability Detail
The vulnerability in Jansson allows an attacker to craft a malicious JSON file that triggers a stack exhaustion issue during parsing. By exploiting this vulnerability, an attacker could cause a denial of service (DoS) condition in applications that rely on Jansson. The issue has been fixed by limiting the parsing depth to 2048, preventing stack exhaustion.
How To Fix
Minimum fixed version
2.3.1-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade janssonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the fix by upgrading the jansson package.
Conclusion
The stack exhaustion vulnerability in jansson can be mitigated by upgrading the package to the fixed version. It is important to promptly apply the fix to prevent potential crashes and denial of service conditions. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jansson →
FAQ
Jansson is a C library for working with JSON data. It provides functions for encoding, decoding, and manipulating JSON files.
The vulnerability could lead to a crash in applications that use Jansson, resulting in a denial of service (DoS) condition.
You can fix this vulnerability by upgrading the jansson package to version 2.3.1-2+deb7u1 or later.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by upgrading the jansson package.
For more information about this vulnerability, you can refer to the Debian Security Advisory DLA-471-1.
Related vulnerabilities
Recent vulnerabilities recorded for jansson.
