CVE-2024-31755: Null Pointer Dereference

Q: What is the severity of CVE-2024-31755?

CVE-2024-31755 has been classified as a high-severity vulnerability due to the potential for remote code execution resulting from a segmentation violation.

Q: How do I fix CVE-2024-31755?

To mitigate CVE-2024-31755, users should upgrade to cJSON version 1.7.18 or later, or any patched version provided by their operating system vendor.

Q: What software is affected by CVE-2024-31755?

CVE-2024-31755 affects cJSON version 1.7.17 and earlier versions across various distributions, including Ubuntu and Debian.

Q: What are the potential consequences of CVE-2024-31755?

Exploitation of CVE-2024-31755 could lead to denial of service and potentially allow attackers to execute arbitrary code on affected systems.

Q: Is there any workaround for CVE-2024-31755?

Currently, the best course of action for CVE-2024-31755 is to apply the available software updates as no reliable workarounds have been reported.

Published Apr 26, 2024

Updated

cJSON v1.7.17 was discovered to contain a segmentation violation which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c.

Other sources

cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c.

— Ubuntu

Affected Software

9 affected componentsFixes available

ubuntu/cjson<1.7.15-1ubuntu0.1~

1.7.15-1ubuntu0.1~

ubuntu/cjson<1.7.16-1ubuntu0.2

1.7.16-1ubuntu0.2

ubuntu/cjson<1.7.17-1ubuntu0.1~

1.7.17-1ubuntu0.1~

ubuntu/cjson<1.7.18

1.7.18

debian/cjson<=1.7.15-1+deb12u1

1.7.14-1+deb11u11.7.18-3

Cjson Project Cjson=1.7.17

redhat/cJSON<1.7.18

1.7.18

Microsoft azl3 apparmor 3.1.7-1<3.1.7-1

3.1.7-1

Microsoft cbl2 apparmor 3.0.4-4<3.0.4-4

3.0.4-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/cjson to a version that resolves this vulnerability.
Fixed in 1.7.15-1ubuntu0.1~
Upgrade
Upgrade ubuntu/cjson to a version that resolves this vulnerability.
Fixed in 1.7.16-1ubuntu0.2
Upgrade
Upgrade ubuntu/cjson to a version that resolves this vulnerability.
Fixed in 1.7.17-1ubuntu0.1~
Upgrade
Upgrade ubuntu/cjson to a version that resolves this vulnerability.
Fixed in 1.7.18
Upgrade
Upgrade debian/cjson to a version that resolves this vulnerability.
Fixed in 1.7.14-1+deb11u1Fixed in 1.7.18-3
Upgrade
Upgrade redhat/cJSON to a version that resolves this vulnerability.
Fixed in 1.7.18
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.7-1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.4-4

Event History

Apr 26, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

Affected Software

Data Sourced

via Red Hat·04:23 AM

DescriptionSeverityAffected Software

May 1, 2024

Data Sourced

via Microsoft·07:00 AM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·07:00 AM

Affected Software

Updated

via Microsoft·07:00 AM

DescriptionSeverity

May 23, 2024

Data Sourced

via Launchpad·04:29 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6784-1

Frequently Asked Questions

What is the severity of CVE-2024-31755?

CVE-2024-31755 has been classified as a high-severity vulnerability due to the potential for remote code execution resulting from a segmentation violation.

How do I fix CVE-2024-31755?

To mitigate CVE-2024-31755, users should upgrade to cJSON version 1.7.18 or later, or any patched version provided by their operating system vendor.

What software is affected by CVE-2024-31755?

CVE-2024-31755 affects cJSON version 1.7.17 and earlier versions across various distributions, including Ubuntu and Debian.

What are the potential consequences of CVE-2024-31755?

Exploitation of CVE-2024-31755 could lead to denial of service and potentially allow attackers to execute arbitrary code on affected systems.

Is there any workaround for CVE-2024-31755?

Currently, the best course of action for CVE-2024-31755 is to apply the available software updates as no reliable workarounds have been reported.

CVE-2024-31755: Null Pointer Dereference

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2024-31755?

How do I fix CVE-2024-31755?

What software is affected by CVE-2024-31755?

What are the potential consequences of CVE-2024-31755?

Is there any workaround for CVE-2024-31755?

Company

Resources

Contact