Bug 863301 (CVE-2013-6401) - VUL-0: CVE-2013-6401: libjansson: hash table collisions CPU usage DoS
Summary: VUL-0: CVE-2013-6401: libjansson: hash table collisions CPU usage DoS
Status: RESOLVED FIXED
Alias: CVE-2013-6401
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2014-03-24
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sle11-sp2:56601
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-11 15:18 UTC by Alexander Bergmann
Modified: 2014-04-01 06:52 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
jansson-hashfix.patch (862 bytes, patch)
2014-02-26 10:35 UTC, Marcus Meissner 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-02-11 15:18:16 UTC 
Florian Weimer and Eric Sesterhenn reported an issue with Jansson, a C library for encoding, decoding and manipulating JSON data.

The problem exists inside the hashing implementation and results in possible prediction of hash collisions.

Upstream fixes:
https://github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4
https://github.com/akheron/jansson/commit/42016a35c8907e477be73b0b5d06cc09af231ee4

CVE-2013-6401 was assigned to this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6401
https://bugzilla.redhat.com/show_bug.cgi?id=1035538
https://github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4
http://comments.gmane.org/gmane.comp.security.oss.general/12099
Comment 1 Swamp Workflow Management 2014-02-11 23:00:17 UTC 
bugbot adjusting priority
Comment 7 Marcus Meissner 2014-02-26 10:35:55 UTC 
Created attachment 580084 [details]
jansson-hashfix.patch

Here is a minimalistic patch, which will XOR a seed that is calculated on startup from the usec of the system time.

Untested. ;)
Comment 8 Marcus Meissner 2014-02-26 10:40:16 UTC 
makes the attack harder and less generic. an attacker woudl need to probe more and estimate remote efforts...
Comment 9 Alexander Bergmann 2014-03-07 15:59:28 UTC 
Jordi, could you test Marcus' jansson-hashfix.patch. It should be sufficient enough to have a minimal randomness inside the hash generation to avoid collisions.
Comment 10 Swamp Workflow Management 2014-03-10 15:22:52 UTC 
The SWAMPID for this issue is 56600.
This issue was rated as moderate.
Please submit fixed packages until 2014-03-24.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 11 SMASH SMASH 2014-03-10 15:25:11 UTC 
Affected packages:

SLE-11-SP3: libjansson
SLE-11-SP2: libjansson
SLE-11-SP2-PRODUCTS: libjansson
Comment 12 Bernhard Wiedemann 2014-03-10 16:00:20 UTC 
This is an autogenerated message for OBS integration:
This bug (863301) was mentioned in
https://build.opensuse.org/request/show/225475 12.3 / libjansson
https://build.opensuse.org/request/show/225476 13.1 / libjansson
Comment 13 Bernhard Wiedemann 2014-03-10 18:00:14 UTC 
This is an autogenerated message for OBS integration:
This bug (863301) was mentioned in
https://build.opensuse.org/request/show/225491 13.1 / libjansson
https://build.opensuse.org/request/show/225492 12.3 / libjansson
Comment 15 Bernhard Wiedemann 2014-03-11 10:00:14 UTC 
This is an autogenerated message for OBS integration:
This bug (863301) was mentioned in
https://build.opensuse.org/request/show/225552 12.3 / libjansson
https://build.opensuse.org/request/show/225553 13.1 / libjansson
Comment 16 Swamp Workflow Management 2014-03-19 10:04:23 UTC 
openSUSE-SU-2014:0394-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 863301
CVE References: CVE-2013-6401
Sources used:
openSUSE 13.1 (src):    libjansson-2.3.1-7.4.1
openSUSE 12.3 (src):    libjansson-2.3.1-5.4.1
Comment 17 Marcus Meissner 2014-03-31 15:14:05 UTC 
released
Comment 18 Swamp Workflow Management 2014-03-31 19:45:35 UTC 
Update released for: libjansson4
Products:
SLE-STUDIOONSITE 1.3 (x86_64)
Comment 19 Swamp Workflow Management 2014-03-31 23:04:23 UTC 
SUSE-SU-2014:0467-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 863301
CVE References: CVE-2013-6401
Sources used:
SUSE Studio Onsite 1.3 (src):    libjansson-2.2.1-0.9.10.1