CVE-2021-42836: Input Validation
First published: Fri Oct 22 2021(Updated: )
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/tidwall/gjson | <1.9.3 | 1.9.3 |
| Gjson Project Gjson | <1.9.3 | |
| IBM Cloud Pak for Security | <=1.10.0.0 - 1.10.11.0 | |
| IBM QRadar Suite Software | <=1.10.12.0 - 1.10.16.0 | |
| <1.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/211919
- https://www.ibm.com/support/pages/node/7080058 (Advisory)
- https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
- https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
- https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
- https://github.com/tidwall/gjson/issues/236
- https://github.com/tidwall/gjson/issues/237
Frequently Asked Questions
What is CVE-2021-42836?
CVE-2021-42836 is a vulnerability in the GJSON package for Go that allows a ReDoS attack.
How does CVE-2021-42836 affect me?
If you are using GJSON version 1.9.3 or earlier, your application may be vulnerable to a ReDoS attack.
How severe is CVE-2021-42836?
CVE-2021-42836 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2021-42836?
To fix CVE-2021-42836, upgrade to GJSON version 1.9.3 or later.
Where can I find more information about CVE-2021-42836?
You can find more information about CVE-2021-42836 on the NIST National Vulnerability Database and the GitHub issues for GJSON.
- collector/github-advisory-latest
- alias/GHSA-ppj4-34rq-v8j9
- alias/CVE-2021-42836
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/references
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- agent/trending
- package-manager/go
- vendor/gjson project
- canonical/gjson project gjson
- vendor/ibm
- canonical/ibm cloud pak for security
- version/ibm cloud pak for security/1.10.0.0 - 1.10.11.0
- canonical/ibm qradar suite software
- version/ibm qradar suite software/1.10.12.0 - 1.10.16.0