CVE-2020-36067
published 2021-01-05CVE-2020-36067: GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
PriorityP432high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.39%
69.4th percentile
GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | golang-github-tidwall-gjson | < golang-github-tidwall-gjson 1.6.7-1 (bookworm) | golang-github-tidwall-gjson 1.6.7-1 (bookworm) |
| github.com | tidwall_gjson | >= 0 < 1.6.6 | 1.6.6 |
| gjson_project | gjson | <= 1.6.5 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Validation of Array Index in GJSON
ghsa·2023-02-06
CVE-2020-36067 [HIGH] CWE-129 Improper Validation of Array Index in GJSON
Improper Validation of Array Index in GJSON
GJSON < 1.6.6 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
OSV
Improper Validation of Array Index in GJSON
osv·2023-02-06
CVE-2020-36067 [HIGH] Improper Validation of Array Index in GJSON
Improper Validation of Array Index in GJSON
GJSON < 1.6.6 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
OSV
Panic due to improper input validation in ForEach in github.com/tidwall/gjson
osv·2021-04-14
CVE-2020-36067 Panic due to improper input validation in ForEach in github.com/tidwall/gjson
Panic due to improper input validation in ForEach in github.com/tidwall/gjson
Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.
OSV
CVE-2020-36067: GJSON <=v1
osv·2021-01-05·CVSS 7.5
CVE-2020-36067 [HIGH] CVE-2020-36067: GJSON <=v1
GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
Debian
CVE-2020-36067: golang-github-tidwall-gjson - GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime err...
vendor_debian·2020·CVSS 7.5
CVE-2020-36067 [HIGH] CVE-2020-36067: golang-github-tidwall-gjson - GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime err...
GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
Scope: local
bookworm: resolved (fixed in 1.6.7-1)
bullseye: resolved (fixed in 1.6.7-1)
forky: resolved (fixed in 1.6.7-1)
sid: resolved (fixed in 1.6.7-1)
trixie: resolved (fixed in 1.6.7-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-05
Published