What is GHSA-w942-gw6m-p62c?

GHSA-w942-gw6m-p62c is a security advisory published by GitHub Security Advisories with High severity. Denial of service in GJSON

Which CVE IDs does GHSA-w942-gw6m-p62c cover?

GHSA-w942-gw6m-p62c covers the following CVE IDs: CVE-2020-35380. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w942-gw6m-p62c?

GHSA-w942-gw6m-p62c has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-w942-gw6m-p62c?

GHSA-w942-gw6m-p62c affects 1 product, including: go/github.com/tidwall/gjson:\u003c 1.6.4.

GHSA-w942-gw6m-p62cHighCVSS 7.5

Denial of service in GJSON

Vendor

GitHub Security Advisories

Published

June 23, 2021

Last Modified

August 30, 2023

🔗 CVE IDs covered (1)

CVE-2020-35380 →

📋 Description

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.

🎯 Affected products1

go/github.com/tidwall/gjson:< 1.6.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-35380
https://github.com/tidwall/gjson/issues/192
https://github.com/tidwall/gjson/commit/f0ee9ebde4b619767ae4ac03e8e42addb530f6bc
https://pkg.go.dev/vuln/GO-2021-0059
https://github.com/advisories/GHSA-w942-gw6m-p62c