Incorrect Regular Expression in gjson - CVE-2021-42836
Published: June 30, 2022
Vulnerability identifier: #VU64826
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-42836
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
gjson
QRadar Suite
IBM Cloud Pak for Watson AIOps
Netcool Operations Insight
QRadar Suite
IBM Cloud Pak for Watson AIOps
Netcool Operations Insight
How to mitigate CVE-2021-42836
Install update from vendor's website.
gjson - update to 1.9.3
QRadar Suite - update to 1.10.17.0
IBM Cloud Pak for Watson AIOps - update to 3.5.1
Netcool Operations Insight - update to 1.6.7
QRadar Suite - update to 1.10.17.0
IBM Cloud Pak for Watson AIOps - update to 3.5.1
Netcool Operations Insight - update to 1.6.7
External References
- https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
- https://github.com/tidwall/gjson/issues/237
- https://github.com/tidwall/gjson/issues/236
- https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
- https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944