CVE-2021-42248
First published: Tue May 24 2022(Updated: )
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references. ## Original Description GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gjson Project Gjson | <=1.9.2 | |
| IBM Cloud Pak for Security | <=1.10.0.0 - 1.10.11.0 | |
| IBM QRadar Suite Software | <=1.10.12.0 - 1.10.16.0 | |
| go/github.com/tidwall/gjson | <1.9.3 | 1.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/tidwall/gjson/issues/237
- https://exchange.xforce.ibmcloud.com/vulnerabilities/227236
- https://www.ibm.com/support/pages/node/7080058 (Advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2021-42248
- https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
- https://github.com/tidwall/gjson/issues/236
- https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
- https://pkg.go.dev/vuln/GO-2021-0265
- https://github.com/advisories/GHSA-c9gm-7rfj-8w5h (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-42248.
What is the severity of CVE-2021-42248?
The severity of CVE-2021-42248 is high (7.5).
Which software versions are affected by CVE-2021-42248?
GJSON versions up to and including 1.9.2, IBM Cloud Pak for Security versions 1.10.0.0 to 1.10.11.0, and IBM QRadar Suite Software versions 1.10.12.0 to 1.10.16.0 are affected.
What is the impact of CVE-2021-42248?
CVE-2021-42248 can be exploited by a remote attacker to cause a denial of service (DoS).
Is there a fix available for CVE-2021-42248?
It is recommended to update to a patched version of the affected software to fix CVE-2021-42248.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/status
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c9gm-7rfj-8w5h
- alias/CVE-2021-42248
- agent/software-canonical-lookup
- collector/nvd-cve
- agent/references
- agent/last-modified-date
- agent/severity
- agent/description
- agent/softwarecombine
- agent/event
- agent/author
- collector/github-advisory
- agent/tags
- collector/ibm-support
- source/IBM
- vendor/gjson project
- canonical/gjson project gjson
- version/gjson project gjson/1.9.2
- status/rejected
- package-manager/go
- vendor/ibm
- canonical/ibm cloud pak for security
- version/ibm cloud pak for security/1.10.0.0 - 1.10.11.0
- canonical/ibm qradar suite software
- version/ibm qradar suite software/1.10.12.0 - 1.10.16.0