SB2021102217 - Multiple vulnerabilities in tidwall gjson

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect Regular Expression (CVE-ID: CVE-2021-42836)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

2) Incorrect Regular Expression (CVE-ID: CVE-2021-42248)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted JSON input to the application and perform regular expression denial of service (ReDos) attack.

Remediation

Install update from vendor's website.

References

• https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
• https://github.com/tidwall/gjson/issues/237
• https://github.com/tidwall/gjson/issues/236
• https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
• https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944