Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 581954 (CVE-2016-4425) - <dev-libs/jansson-2.9: stack exhaustion parsing a JSON file (CVE-2016-4425)
Summary: <dev-libs/jansson-2.9: stack exhaustion parsing a JSON file (CVE-2016-4425)
Status: RESOLVED FIXED
Alias: CVE-2016-4425
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on: 598832
Blocks:
  Show dependency tree
 
Reported: 2016-05-03 09:17 UTC by Agostino Sarubbo
Modified: 2017-01-21 08:05 UTC (History)
1 user (show)

See Also:
Package list:
=dev-libs/jansson-2.9
Runtime testing required: No
kensington: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-05-03 09:17:23 UTC 
From ${URL} :

A vulnerability was found in jansson. Parsing a maliciously crafted JSON file could cause the 
application to crash. This crash is caused by stack exhaustion.

References:

http://seclists.org/oss-sec/2016/q2/181

External references:

https://github.com/akheron/jansson/issues/282

Possible fix:

https://github.com/akheron/jansson/pull/283


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Agostino Sarubbo gentoo-dev 2016-05-09 10:12:56 UTC 
fixed here:
https://github.com/akheron/jansson/pull/284
Comment 2 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2016-11-03 15:34:57 UTC 
commit fd6313631179bba8b0e2b9d9cedeadc2d2151ad1
Author: Lars <polynomial-c@gentoo.org>
Date:   Thu Nov 3 11:57:34 2016

    dev-libs/jansson: Bump to version 2.9 (bug #598832) and to EAPI-6.

    Added multilib support (bug 570006).
    This release also fixes the security issue reported in bug #581954.
    Closes: https://github.com/gentoo/gentoo/pull/2728

    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2017-01-01 13:32:40 UTC 
GLSA Vote: No

@arches, please stabilize.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2017-01-01 13:32:54 UTC 
CVE-2016-4425 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4425):
  Jansson 2.7 and earlier allows context-dependent attackers to cause a denial
  of service (deep recursion, stack consumption, and crash) via crafted JSON
  data.
Comment 5 Agostino Sarubbo gentoo-dev 2017-01-01 22:10:37 UTC 
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2017-01-02 09:56:08 UTC 
x86 stable
Comment 7 Agostino Sarubbo gentoo-dev 2017-01-03 10:42:31 UTC 
ppc64 stable
Comment 8 Tobias Klausmann (RETIRED) gentoo-dev 2017-01-05 12:36:38 UTC 
Stable on alpha.
Comment 9 Markus Meier gentoo-dev 2017-01-08 18:29:54 UTC 
arm stable
Comment 10 Agostino Sarubbo gentoo-dev 2017-01-11 10:41:35 UTC 
sparc stable
Comment 11 Agostino Sarubbo gentoo-dev 2017-01-15 15:53:16 UTC 
ppc stable
Comment 12 Jeroen Roovers (RETIRED) gentoo-dev 2017-01-15 20:58:28 UTC 
Stable for HPPA.
Comment 13 Agostino Sarubbo gentoo-dev 2017-01-17 14:29:18 UTC 
ia64 stable.

Maintainer(s), please cleanup.
Comment 14 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-19 19:38:53 UTC 
Restoring whiteboard.

Cleanup PR: https://github.com/gentoo/gentoo/pull/3546
Comment 15 Aaron Bauman (RETIRED) gentoo-dev 2017-01-21 08:05:40 UTC 
Tree is clean.