CVE-2013-6401
Published: 21 March 2014
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
From the Ubuntu Security Team
Florian Weimer discovered that Jansson incorrectly handled hash collisions predictability. An attacker could possibly use this issue to cause a denial of service.
Priority
Status
Package | Release | Status |
---|---|---|
jansson Launchpad, Ubuntu, Debian |
precise |
Ignored
(end of life)
|
artful |
Not vulnerable
(2.6-1)
|
|
bionic |
Not vulnerable
(2.6-1)
|
|
lucid |
Does not exist
|
|
quantal |
Ignored
(end of life)
|
|
saucy |
Ignored
(end of life)
|
|
trusty |
Released
(2.5-2ubuntu0.1)
|
|
upstream |
Released
(2.6-1)
|
|
utopic |
Not vulnerable
(2.6-1)
|
|
vivid |
Not vulnerable
(2.6-1)
|
|
wily |
Not vulnerable
(2.6-1)
|
|
xenial |
Not vulnerable
(2.6-1)
|
|
yakkety |
Not vulnerable
(2.6-1)
|
|
zesty |
Not vulnerable
(2.6-1)
|
|
Patches: upstream: https://github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4 upstream: https://github.com/akheron/jansson/commit/42016a35c8907e477be73b0b5d06cc09af231ee4 |