CVE-2013-6371

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
json-cjson-c
𝑥
< 0.12-20140410
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
json-c
bookworm
0.16-2
fixed
bullseye
0.15-2+deb11u1
fixed
bullseye (security)
0.15-2+deb11u1
fixed
sid
0.18+ds-1
fixed
squeeze
no-dsa
trixie
0.18+ds-1
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
json-c
lucid
ignored
precise
Fixed 0.9-1ubuntu1.1
released
quantal
ignored
saucy
Fixed 0.11-2ubuntu1.2
released
trusty
Fixed 0.11-3ubuntu1.2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libjson-c-devel
suse enterprise desktop 15
0.13-1.19
fixed
suse enterprise desktop 15 SP1
0.13-1.19
fixed
suse enterprise desktop 15 SP2
0.13-1.19
fixed
suse enterprise desktop 15 SP3
0.13-1.19
fixed
suse enterprise desktop 15 SP4
0.13-3.3.1
fixed
suse enterprise desktop 15 SP5
0.13-3.3.1
fixed
suse enterprise sap 15
0.13-1.19
fixed
suse enterprise sap 15 SP1
0.13-1.19
fixed
suse enterprise sap 15 SP2
0.13-1.19
fixed
suse enterprise sap 15 SP3
0.13-1.19
fixed
suse enterprise sap 15 SP4
0.13-3.3.1
fixed
suse enterprise sap 15 SP5
0.13-3.3.1
fixed
suse enterprise server 15
0.13-1.19
fixed
suse enterprise server 15 SP1
0.13-1.19
fixed
suse enterprise server 15 SP2
0.13-1.19
fixed
suse enterprise server 15 SP3
0.13-1.19
fixed
suse enterprise server 15 SP4
0.13-3.3.1
fixed
suse enterprise server 15 SP5
0.13-3.3.1
fixed
libjson-c2
suse enterprise sap 12 SP5
0.11-2.22
fixed
suse enterprise server 12 SP5
0.11-2.22
fixed
libjson-c2-32bit
suse enterprise sap 12 SP5
0.11-2.22
fixed
suse enterprise server 12 SP5
0.11-2.22
fixed
libjson-c3
suse enterprise desktop 15
0.13-1.19
fixed
suse enterprise desktop 15 SP1
0.13-1.19
fixed
suse enterprise desktop 15 SP2
0.13-1.19
fixed
suse enterprise desktop 15 SP3
0.13-1.19
fixed
suse enterprise desktop 15 SP4
0.13-3.3.1
fixed
suse enterprise desktop 15 SP5
0.13-3.3.1
fixed
suse enterprise sap 15
0.13-1.19
fixed
suse enterprise sap 15 SP1
0.13-1.19
fixed
suse enterprise sap 15 SP2
0.13-1.19
fixed
suse enterprise sap 15 SP3
0.13-1.19
fixed
suse enterprise sap 15 SP4
0.13-3.3.1
fixed
suse enterprise sap 15 SP5
0.13-3.3.1
fixed
suse enterprise server 15
0.13-1.19
fixed
suse enterprise server 15 SP1
0.13-1.19
fixed
suse enterprise server 15 SP2
0.13-1.19
fixed
suse enterprise server 15 SP3
0.13-1.19
fixed
suse enterprise server 15 SP4
0.13-3.3.1
fixed
suse enterprise server 15 SP5
0.13-3.3.1
fixed
libjson-c3-32bit
suse enterprise desktop 15
0.13-1.19
fixed
suse enterprise desktop 15 SP1
0.13-1.19
fixed
suse enterprise desktop 15 SP2
0.13-1.19
fixed
suse enterprise desktop 15 SP3
0.13-1.19
fixed
suse enterprise desktop 15 SP4
0.13-3.3.1
fixed
suse enterprise desktop 15 SP5
0.13-3.3.1
fixed
suse enterprise sap 15
0.13-1.19
fixed
suse enterprise sap 15 SP1
0.13-1.19
fixed
suse enterprise sap 15 SP2
0.13-1.19
fixed
suse enterprise sap 15 SP3
0.13-1.19
fixed
suse enterprise sap 15 SP4
0.13-3.3.1
fixed
suse enterprise sap 15 SP5
0.13-3.3.1
fixed
suse enterprise server 15
0.13-1.19
fixed
suse enterprise server 15 SP1
0.13-1.19
fixed
suse enterprise server 15 SP2
0.13-1.19
fixed
suse enterprise server 15 SP3
0.13-1.19
fixed
suse enterprise server 15 SP4
0.13-3.3.1
fixed
suse enterprise server 15 SP5
0.13-3.3.1
fixed
rsyslog
suse enterprise desktop 15
8.33.1-1.30
fixed
suse enterprise desktop 15 SP1
8.33.1-3.9.1
fixed
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-diag-tools
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
rsyslog-doc
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
rsyslog-module-gssapi
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-gtls
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-mmnormalize
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
rsyslog-module-mysql
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-pgsql
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-relp
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-snmp
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-udpspoof
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
json-c
RHEL 7
0:0.11-4.el7_0
fixed
json-c-devel
RHEL 7
0:0.11-4.el7_0
fixed
json-c-doc
RHEL 7
0:0.11-4.el7_0
fixed
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html
http://secunia.com/advisories/57791
http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/66715
https://bugzilla.redhat.com/show_bug.cgi?id=1032311
https://exchange.xforce.ibmcloud.com/vulnerabilities/92541
https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html
http://secunia.com/advisories/57791
http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/66715
https://bugzilla.redhat.com/show_bug.cgi?id=1032311
https://exchange.xforce.ibmcloud.com/vulnerabilities/92541
https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015