CVE-2021-32292

An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 71.05%
Affected Products (NVD)
VendorProductVersion
netappactive_iq_unified_manager
-
json-cjson-c
0.15-20200726
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
V3.1.0 ≤
𝑥
< V3.1.5
ADP
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
V3.1.0 ≤
𝑥
< V3.1.5
ADP
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP
V3.1.0 ≤
𝑥
< V3.1.5
ADP
Debian logo
Debian Releases
Debian Product
Codename
json-c
bookworm
0.16-2
fixed
bullseye
0.15-2+deb11u1
fixed
bullseye (security)
0.15-2+deb11u1
fixed
buster
not-affected
sid
0.18+ds-1
fixed
trixie
0.18+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
json-c
bionic
not-affected
focal
not-affected
jammy
Fixed 0.15-3~ubuntu1.22.04.2
released
lunar
not-affected
trusty
not-affected
xenial
not-affected
Azure Linux logo
Azure Linux Releases
Azure Package
Release
json-c
CBL-Mariner 2.0
0:0.15-2.cm2
fixed
Common Weakness Enumeration
References
https://github.com/json-c/json-c/issues/654
https://security.netapp.com/advisory/ntap-20230929-0010/
https://www.debian.org/security/2023/dsa-5486
https://github.com/json-c/json-c/issues/654
https://security.netapp.com/advisory/ntap-20230929-0010/
https://www.debian.org/security/2023/dsa-5486
https://cert-portal.siemens.com/productcert/html/ssa-398330.html