CVE-2020-12762: json-c json-c – CVSS 7.8 · Watchpost

← All vulnerabilities

CVE-2020-12762

HIGH 7.8CVE-2020-12762 · Published 09/05/2020 · updated 14/10/2026

In short

CVE-2020-12762 is a HIGH (CVSS 7.8) vulnerability affecting json-c (json-c), sinec ins (siemens).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.6% of all vulnerabilities.
Fix: update to 0.15-20200726 or later.

Package	Affected versions	Patched versions
json-c json-c	`< 0.15-20200726`	`0.15-20200726`
sinec ins siemens	`= 1.0`	No fix yet

Description

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

References

cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf · Third Party Advisory
json-c/json-c#592 · Exploit
rsyslog/libfastjson · Exploit
lists.debian.org/debian-lts-announce/2020/05/msg00032.html · Mailing List
lists.debian.org/debian-lts-announce/2020/05/msg00034.html · Mailing List
lists.debian.org/debian-lts-announce/2020/07/msg00031.html · Mailing List
lists.debian.org/debian-lts-announce/2023/06/msg00023.html · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBR36IXYBHITAZFB5PFBJTED22WO5ONB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W226TSCJBEOXDUFVKNWNH7ETG7AR6MCS

More vulnerabilities in json-c

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free