github.com/tidwall/gjson is vulnerable to Denial of service

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-36066 · ADVISORY
• tidwall/gjson · WEB
• tidwall/gjson · WEB
• tidwall/gjson commit 9f58baa · WEB
• tidwall/match commit c2f5341 · WEB
• tidwall/gjson · PACKAGE
• pkg.go.dev/vuln/GO-2022-0957 · WEB

github.com/tidwall/gjson のその他の脆弱性

• CVE-2020-36067高 7.5GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
• CVE-2020-35380高 7.5GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.