Moderate Vulnerability in libfastjson: Integer Overflow and Out-of-Bounds Write
Summary
RLSA-2023:6431: Moderate: libfastjson security update. Affects libfastjson versions < 0:0.99.9-5.el9. Fixed in 0:0.99.9-5.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libfastjson is a library that provides essential functions for handling JavaScript Object Notation (JSON) in C. It allows users to construct JSON objects, output them as JSON-formatted strings, and convert JSON-formatted strings back to C representations. This library is widely used for applications that require efficient JSON processing. However, it has been found to be vulnerable to specific security issues that could lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2020-12762 in the libfastjson library is characterized by an integer overflow and out-of-bounds write that can occur when processing a large JSON file. This flaw can lead to memory corruption, which may allow an attacker to execute arbitrary code or crash the application. The severity of this vulnerability is underscored by its CVSS score of 7.8, indicating a high risk to systems utilizing this library.
How To Fix
Minimum fixed version
0:0.99.9-5.el9
This is the first release that contains the fix.
sudo dnf update libfastjsonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation to restrict the size of JSON files processed by the application. This can help mitigate the risk of triggering the vulnerability until a proper patch is applied.
Conclusion
The libfastjson library has a moderate vulnerability that could lead to serious security issues if not addressed. It is crucial for users to update to the patched version to safeguard their applications. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libfastjson →
FAQ
CVE-2020-12762 is a vulnerability in the libfastjson library that allows for integer overflow and out-of-bounds write when handling large JSON files.
Exploitation of this vulnerability could lead to memory corruption, allowing attackers to execute arbitrary code or crash the application.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, implementing input validation to restrict the size of JSON files can help mitigate the risk until a patch is applied.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libfastjson.
