Jansson Predictable Hash Collisions Denial of Service Vulnerability

Bugtraq ID:	65503
Class:	Design Error
CVE:	CVE-2013-6401
Remote:	Yes
Local:	No
Published:	Feb 12 2014 12:00AM
Updated:	May 07 2015 05:08PM
Credit:	Florian Weimer
Vulnerable:	Jansson Jansson 2.4-3 Jansson Jansson 2.4-2
Not Vulnerable:

Jansson Predictable Hash Collisions Denial of Service Vulnerability

Jansson is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to trigger denial-of-service conditions due to excessive CPU consumption.

Jansson 2.4-2 and 2.4-3 are vulnerable; other versions may also be affected.

Jansson Predictable Hash Collisions Denial of Service Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Jansson Predictable Hash Collisions Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jansson Predictable Hash Collisions Denial of Service Vulnerability

References:

• Bug 1035538 - (CVE-2013-6401) CVE-2013-6401 jansson: hash table collisions CPU u (Red Hat Bugzilla)
  
• CVE-2013-6401: Change hash function, randomize hashes (akheron)
  
• Jansson Homepage (Jansson )
  
• Re: CVE-2013-6401 Jansson hash collision issue (SecLists.Org)