摘要:
rapidjson security update
安全等级: High
公告ID: KylinSec-SA-2024-4805
发布日期: 2024年7月19日
关联CVE: CVE-2024-38517
RapidJSON as a fast JSON parser which generator for c++. It`s inspired by RapidXML. It`s supports both SAX & DOM style API. It`s small but complete. It`s fast, It`s preformance can be comparabel to strlen(). It`s self-contained. It doesn`t depend on external libraries such as BOOST. It`s Unicode and memory friendly, each JSON valude occupies exactly 16/20 bytes for most 32/64-bit machines. It`s suport UTF-8 UTF-16 UTF-32 (LE & BE).
Security Fix(es):
Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.(CVE-2024-38517)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-38517 | KY3.4-5A | rapidjson | Fixed |
| CVE-2024-38517 | KY3.5.2 | rapidjson | Fixed |
| CVE-2024-38517 | V6 | rapidjson | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| rapidjson-devel | noarch | 1.1.0-12.kb1.ky3_4 |
| rapidjson-help | noarch | 1.1.0-12.kb1.ky3_4 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| rapidjson-devel | noarch | 1.1.0-13.ks6 |
| rapidjson-help | noarch | 1.1.0-13.ks6 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| rapidjson-devel | noarch | 1.1.0-11.ky3_5.kb1 |
| rapidjson-help | noarch | 1.1.0-11.ky3_5.kb1 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
