CVE-2021-42248

HIGH7.5

Duplicate Advisory: ReDoS via crafted JSON input in GJSON

Published: 5/25/2022Modified: 5/19/2024

Also known as:GHSA-c9gm-7rfj-8w5h GHSA-ppj4-34rq-v8j9GO-2021-0265

Description

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references. ## Original Description GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.

Affected packages (3)

Go/github.com/tidwall/gjsonfrom 0, < 1.9.3
Go/github.com/tidwall/gjsonfrom 0, < 1.9.3
Go/github.com/tidwall/gjsonfrom 0, < 1.9.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-42248
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-42836
PATCHhttps://github.com/tidwall/gjson
WEBhttps://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
WEBhttps://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
WEBhttps://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
WEBhttps://github.com/tidwall/gjson/issues/236
WEBhttps://github.com/tidwall/gjson/issues/237
WEBhttps://pkg.go.dev/vuln/GO-2021-0265