CVE-2021-42248

HIGH7.5

Duplicate Advisory: ReDoS via crafted JSON input in GJSON

發布日:2022/5/25修改日:2024/5/19

也稱為:GHSA-c9gm-7rfj-8w5h GHSA-ppj4-34rq-v8j9GO-2021-0265

描述

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references. ## Original Description GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.

受影響套件(3)

Go/github.com/tidwall/gjsonfrom 0, < 1.9.3
Go/github.com/tidwall/gjsonfrom 0, < 1.9.3
Go/github.com/tidwall/gjsonfrom 0, < 1.9.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-42248
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-42836
PATCHhttps://github.com/tidwall/gjson
WEBhttps://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
WEBhttps://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
WEBhttps://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
WEBhttps://github.com/tidwall/gjson/issues/236
WEBhttps://github.com/tidwall/gjson/issues/237
WEBhttps://pkg.go.dev/vuln/GO-2021-0265