CVE-2018-1000215 Denial of service in n/a
An attacker can cause a denial of service in applications using the cJSON library by triggering a memory leak during data printing under low memory conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000215?
CVE-2018-1000215 is a high-severity denial of service vulnerability in n/a, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS). This attack appear to be exploitable via If the attacker can force the data to be printed and the system is in low memory it can force a leak of memory. This vulnerability appears to have been fixed in 1.7.7.
Weakness: CWE-772
Which versions are affected by CVE-2018-1000215?
It affects 1 product.
Products include Davegamble Cjson.
How do I fix CVE-2018-1000215?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1000215 being exploited?
There is no known exploitation of CVE-2018-1000215 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-41919, DEBIAN-CVE-2018-1000215, GHSA-9xc3-9g76-hcvx.