Miggo Logo

CVE-2020-36325:
An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's...

7.5

CVSS Score
3.1

Basic Information

EPSS Score
0.6063%
Published
5/24/2022
Updated
3/21/2024
KEV Status
No
Technology
-

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis is based on the crash stack trace provided in the GitHub issue #548, which was referenced in the vulnerability details. This stack trace shows the sequence of function calls leading to the out-of-bounds read. Since no specific commit patches were available, the crash log provides the most direct evidence of functions involved at runtime when the vulnerability is triggered. The functions listed are those present in the call stack at the time of the crash, starting from the entry point json_loads down to string_get where the segmentation fault occurred. The vulnerability description explicitly names json_loads as the source of the parsing error.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in J*nsson t*rou** *.**.*. *u* to * p*rsin* *rror in json_lo**s, t**r*'s *n out-o*-*oun*s r***-****ss *u*.

Reasoning

T** *n*lysis is **s** on t** *r*s* st**k tr*** provi*** in t** *it*u* issu* #***, w*i** w*s r***r*n*** in t** vuln*r**ility **t*ils. T*is st**k tr*** s*ows t** s*qu*n** o* *un*tion **lls l***in* to t** out-o*-*oun*s r***. Sin** no sp**i*i* *ommit p*t