search

tidwall / gjson

Get JSON values quickly - JSON parser for Go
MIT License
14.1k stars 846 forks source link

3 High vulnerabilities detected when using an automatic vulnerability-detection tool #217

Closed Schneider-Electric-Carros closed 3 years ago

Schneider-Electric-Carros commented 3 years ago

Context where the vulnerabilities are detected

Steps to reproduce:

Create a Hello World application importing tidwall/gjson Build the application Scan the result with Black Duck Binary Analysis

Expected behavior:

No vulnerablities should be reported.

Actual behavior:

3 High vulnerabilities are detected.

More details on the vulnerabilities:

High (CVE-2020-36066)

GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.

High (CVE-2020-35380)

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.

High (CVE-2020-36067)

GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.

tidwall commented 3 years ago

These issues have already been reported and addressed.