CVE-2020-35380: High severity gjson vulnerability
Published Dec 15, 2020
·Updated
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Affected Software
2 affected componentsFixes available
go/github.com/tidwall/gjson<1.6.4
1.6.4
Gjson Project Gjson<1.6.4
Event History
Dec 15, 2020
CVE Published
via MITRE·08:12 PM
Data Sourced
via MITRE·08:12 PM
Description
Jun 23, 2021
Advisory Published
05:53 PM
Frequently Asked Questions
1
What is CVE-2020-35380?
CVE-2020-35380 is a vulnerability in GJSON that allows attackers to cause a denial of service (DoS) through crafted JSON.
2
How does CVE-2020-35380 work?
CVE-2020-35380 occurs due to improper bounds checking, allowing maliciously crafted JSON objects to trigger an out-of-bounds panic.
3
What is the severity of CVE-2020-35380?
CVE-2020-35380 has a severity rating of 7.5 (High).
4
How can I fix CVE-2020-35380?
To fix CVE-2020-35380, update the affected software to version 1.6.4 or newer.
5
Where can I find more information about CVE-2020-35380?
You can find more information about CVE-2020-35380 on the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2020-35380) and the GitHub repository for GJSON (https://github.com/tidwall/gjson/issues/192).