libjson-c: backport security fixes #3019
Conversation
|
Seems your backported patches appear to lack at least upstream commit json-c/json-c@519dfe1 - means adding more than 11 objects to a JSON structure fails, that likely explain the LuCI problem and will probably cause other subtle issues elsewhere in the system. Is there any reason why we cannot await a proper upstream release? |
|
Well, this vulnerability allows for writes outside of allocated memory so we wanted to patch that ASAP. Well, upstream is really slow with making new releases. |
|
Is there a CVE reference yet? |
|
Thanks @lperkov. @robimarko - can you add a CVE reference to your commit message? Something like |
This backports upstream fixes for the out of bounds write vulnerability in json-c. It was reported and patches in this upstream PR: json-c/json-c#592 Addresses CVE-2020-12762 Signed-off-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Luka Perkov <luka.perkov@sartura.h>
robimarko
force-pushed
the
json-c/vuln-fix
branch
from
4697386
to
fcba60b
Compare
|
@jow- I have added the CVE reference in the commit message. I will take a look at updating to 0.14 soon. |
|
Pulled into my staging tree at https://git.openwrt.org/openwrt/staging/jow.git |
This backports upstream fixes for the out of bounds write vulnerability in json-c.
It was reported and patches in this upstream PR: json-c/json-c#592
It currently breaks LuCI in a sense that Session expired popup will constantly pop up and you can't log in because of it.
There are no errors in logread about it, but since I don't know anything about LuCI can somebody look at it?
Signed-off-by: Robert Marko robert.marko@sartura.hr
Signed-off-by: Luka Perkov luka.perkov@sartura.h