-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
json-c-0.11: Fix CVE-2020-12762 - json-c through 0.14 has an integer overflow and out-of-bounds write ... #612
json-c-0.11: Fix CVE-2020-12762 - json-c through 0.14 has an integer overflow and out-of-bounds write ... #612
Conversation
CI failure is unrelated. Build finishes fine locally. |
Is anyone still using this ancient of a version of json-c? The most recent change on the v0.11 branch was more than 7 years ago. If there's a real world example of someone actually using this version and being unable to upgrade to a newer release, then we could merge this. Otherwise I'm inclined to declare this branch out-of-support and not make any changes here so as to avoid giving the impression that it's actually an active branch. |
Well, Debian Jessie (9.x, oldoldstable), Ubuntu 16.04.6 LTS (Xenial Xerus), and Red Hat Enterprise Linux / CentOS {6,7} are shipping json-c-0.11. I doubt it will be an easy task to update them to json-c-0.12.x, as it is not fully binary compatible, and thus would require to rebuild several components of those distributions. |
Based on a comparison I just did w/ abi-compliance-checker, the one significant change that I see is the removal of the json_tokener_errors[] symbol. I'd be far more inclined to merge a change to 0.12 to drop the "static" from its declaration in json_tokener.c on that branch, and thus restore at ABI compatibility, than to merge this change. |
From the technical POV I get your point, but there is at least another aspect to consider when updating from v0.11 to v0.12 instead of patching v0.11 to fix the CVE: What about existing certifications and/or security audits those distributions and/or products have undergone to be suitable for special audiances? For FIPS-180 certification I know there is a huge difference between adding a patch and updating to a different version:
This consideration at least applies to RHEL {6,7}. |
Apologies for forgetting about this. I still have reservations about making it seem like the old branches are actually active, but since those OS version that use it are still in support for at least a few more years I've merged this PR anyway. |
This PR is a squashed and slightly modified backport of the following commits on the master branch: