CVE-2013-6371: Buffer Overflow
CVE-2013-6370 Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors. CVE-2013-6371 The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
Other sources
Florian Weimer reported that the hash function in the json-c library was weak, and that parsing smallish JSON strings showed quadratic timing behaviour. This could cause an application linked to the json-c library, and that processes some specially-crafted JSON data, to use excessive amounts of CPU.
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6371?
CVE-2013-6371 has a medium severity due to its potential to cause excessive CPU usage.
How can I fix CVE-2013-6371?
To fix CVE-2013-6371, update the json-c library to version 0.12-20140410 or later.
Which software is affected by CVE-2013-6371?
CVE-2013-6371 affects json-c library versions before 0.12-20140410 and Fedora 20.
What type of attack is possible with CVE-2013-6371?
CVE-2013-6371 can lead to denial of service attacks by exploiting quadratic timing behavior in JSON parsing.
Is there a workaround for CVE-2013-6371?
A temporary workaround for CVE-2013-6371 includes limiting the size and complexity of JSON data processed by affected applications.