CVE-2021-32292 Memory corruption in n/a
A stack-buffer-overflow in the json_parse sample program of the json-c library allows attackers to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32292?
CVE-2021-32292 is a critical memory corruption vulnerability in Netapp Active Iq Unified Manager, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
Weakness: CWE-787
Which versions are affected by CVE-2021-32292?
1 open source package ship an affected version, including json-c. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
json-c Bitnami | From 0.15-20200726.0 to 0.15-20200726.0 | None |
Products include Json-C Json-C, Netapp Active Iq Unified Manager.
How do I fix CVE-2021-32292?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-32292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32292 exists.
Sources
Also known as AZL-28060, BIT-json-c-2021-32292, DEBIAN-CVE-2021-32292, DSA-5486-1, GHSA-gf2h-qrq9-jg6v, OESA-2023-1571 and 4 more.