CVE-2018-14632: Out-of-bounds write in github.com/evanphx/json-patch
Summary
CVE-2018-14632: Out-of-bounds write in github.com/evanphx/json-patch. Affects github.com/evanphx/json-patch across 2 version ranges.
< 0.5.2
>= 3.0.0+incompatible, < 3.0.1-0.20180525145409-4c9aadca8f89+incompatible
Fixed in 0.5.2 or 3.0.1-0.20180525145409-4c9aadca8f89+incompatible, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'github.com/evanphx/json-patch' is a Go library that provides functionality for applying JSON patches. It allows users to modify JSON documents by specifying a sequence of operations to be applied. The library is widely used in Go applications for handling JSON data manipulation.
Vulnerability Detail
A malicious JSON patch can trigger an out-of-bounds write attempt in the 'github.com/evanphx/json-patch' package. This vulnerability can be exploited by an attacker to cause a panic, leading to a denial of service (DoS) if the library is exposed to arbitrary user input. The issue originates from improper bounds checking during the patch application process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.5.20.5.2go get github.com/evanphx/json-patch@v0.5.2 -
>= 3.0.0+incompatible, < 3.0.1-0.20180525145409-4c9aadca8f89+incompatible3.0.1-0.20180525145409-4c9aadca8f89+incompatiblego get github.com/evanphx/json-patch@v3.0.1-0.20180525145409-4c9aadca8f89+incompatible
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate user input before applying JSON patches. This can be done by implementing input validation routines that ensure the JSON patch is within the expected bounds and adheres to the intended modifications. Here's an example of input validation code:
func validateJSONPatch(patch []byte) error {
// Perform validation checks on the patch
// Return an error if the patch is deemed malicious or out-of-bounds
}
Conclusion
The 'github.com/evanphx/json-patch' package is vulnerable to an out-of-bounds write issue that can be exploited for denial of service attacks. To address this vulnerability, it is recommended to update the package to the fixed versions mentioned above. If immediate update is not possible, implementing input validation can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/evanphx/json-patch →
FAQ
The vulnerability allows an attacker to trigger a panic in the 'github.com/evanphx/json-patch' package, leading to a denial of service (DoS) if the library is exposed to untrusted user input. This can disrupt the availability of affected applications.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your Gopkg.lock file and alerts you in real-time for any open-source vulnerabilities, including this one.
While there are no publicly known exploits specific to this vulnerability, it is important to address it promptly to prevent potential denial of service attacks. Keeping the 'github.com/evanphx/json-patch' package up to date and implementing input validation can mitigate the risk.
Yes, this vulnerability can be exploited remotely if the affected application exposes the 'github.com/evanphx/json-patch' package to untrusted user input. Attackers can send malicious JSON patches to trigger the out-of-bounds write and cause a panic, resulting in a denial of service.
Yes, the vulnerability has been patched in version 0.5.2 of the 'github.com/evanphx/json-patch' package for Go 1.x projects, and version 3.0.1-0.20180525145409-4c9aadca8f89+incompatible for Go 3.x projects. It is crucial to update to these fixed versions to mitigate the risk.
