CVE-2023-53154: Medium severity cJSON cJSON vulnerability
parsestring in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSONParseWithLength is called.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.4-5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.7-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53154?
CVE-2023-53154 is classified as a medium severity vulnerability due to its potential for exploitation via heap-based buffer over-read.
How do I fix CVE-2023-53154?
To mitigate CVE-2023-53154, upgrade to cJSON version 1.7.18 or later.
What versions of cJSON are affected by CVE-2023-53154?
CVE-2023-53154 affects cJSON versions earlier than 1.7.18.
What is the impact of CVE-2023-53154?
CVE-2023-53154 can lead to a heap-based buffer over-read, potentially allowing an attacker to access sensitive information.
How was CVE-2023-53154 discovered?
CVE-2023-53154 was identified through review of the cJSON code where improper handling of input strings could lead to the vulnerability.