Catalogue CVE

CVE-2024-31755

cJSON vulnerabilities

A flaw was found in cJSON. This issue contains a segmentation violation, which can trigger through the second parameter of the cJSON_SetValuestring function at cJSON.c. cjson: segmentation violation trigger through the second parameter of function cJSON_SetValuestring at cJSON.c Red Hat Satellite 6.15 is affected by this vulnerability as it ships a vulnerable version of cjSON. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravité: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Apr 26, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.65% · Oct 27, 2026

Projects and upstream resources

[cjson][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	cjson	`1.7.18-3.1+deb13u1`	Fixed	[CVE-2024-31755]
Debiantrixie	cjson	`1.7.18-1`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debiantrixie	cjson	`1.7.18-3.1+deb13u1`	Fixed	[CVE-2024-31755]
Debiansid	cjson	`1.7.18-1`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debiansid	cjson	`1.7.19-2`	Fixed	[CVE-2024-31755]
Debianforky	cjson	`1.7.18-1`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debianforky	cjson	`1.7.19-2`	Fixed	[CVE-2024-31755]
Debianbookworm-security	cjson	`1.7.15-1+deb12u4`	Fixed	[CVE-2024-31755]
Debianbookworm	cjson	`1.7.15-1+deb12u2`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debianbookworm	cjson	`1.7.15-1+deb12u4`	Fixed	[CVE-2024-31755]

Showing 10 fix observations. All 19 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	cjson	`1.7.15-1+deb12u2`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	cjson	`1.7.17-1ubuntu0.1~esm2`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	libcjson-dev	`1.7.17-1ubuntu0.1~esm2`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	libcjson1	`1.7.17-1ubuntu0.1~esm2`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	cjson	`1.7.15-1+deb12u2`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debianbookworm	cjson	`1.7.15-1+deb12u4`	Fixed	[CVE-2024-31755]
Debianbookworm-security	cjson	`1.7.15-1+deb12u4`	Fixed	[CVE-2024-31755]
Debianforky	cjson	`1.7.18-1`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debianforky	cjson	`1.7.19-2`	Fixed	[CVE-2024-31755]
Debiansid	cjson	`1.7.18-1`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debiansid	cjson	`1.7.19-2`	Fixed	[CVE-2024-31755]
Debiantrixie	cjson	`1.7.18-1`	FixedDistribution-reported fixed boundary	[CVE-2024-31755]
Debiantrixie	cjson	`1.7.18-3.1+deb13u1`	Fixed	[CVE-2024-31755]
Debiantrixie-security	cjson	`1.7.18-3.1+deb13u1`	Fixed	[CVE-2024-31755]
Opensusetumbleweed	cJSON	`1.7.18-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:14021-1]May 7, 2025, 6:16:01 PM UTC
Ubuntupro	cjson	`1.7.16-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-31755]Apr 22, 2026, 2:48:52 PM UTC
Ubuntupro	cjson	`1.7.16-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-31755]Apr 22, 2026, 2:48:52 PM UTC
Ubuntupro	cjson	`1.7.17-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-31755]Apr 22, 2026, 2:48:52 PM UTC
Ubuntupro	cjson	`1.7.17-1ubuntu0.1~esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-31755]Apr 22, 2026, 2:48:52 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "cjson",
      "status": "fixed",
      "release": "sid",
      "version": "1.7.19-2"
    },
    {
      "name": "cjson",
      "status": "fixed",
      "release": "forky",
      "version": "1.7.19-2"
    },
    {
      "name": "cjson",
      "status": "fixed",
      "release": "trixie",
      "version": "1.7.18-3.1+deb13u1"
    },
    {
      "name": "cjson",
      "status": "fixed",
      "release": "trixie-security",
      "version": "1.7.18-3.1+deb13u1"
    },
    {
      "name": "cjson",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.7.15-1+deb12u4"
    },
    {
      "name": "cjson",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1.7.15-1+deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1071742,
      "name": "cjson",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.7.18-1"
    },
    {
      "bug": 1071742,
      "name": "cjson",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.7.18-1"
    },
    {
      "bug": 1071742,
      "name": "cjson",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.7.18-1"
    },
    {
      "bug": 1071742,
      "name": "cjson",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.7.15-1+deb12u2"
    }
  ],
  "distribution_packages": [
    {
      "name": "cjson",
      "fixed_version": "1.7.15-1+deb12u2",
      "applicability_unknown": true
    },
    {
      "name": "cjson",
      "fixed_version": "1.7.17-1ubuntu0.1~esm2",
      "applicability_unknown": true
    },
    {
      "name": "libcjson-dev",
      "fixed_version": "1.7.17-1ubuntu0.1~esm2",
      "applicability_unknown": true
    },
    {
      "name": "libcjson1",
      "fixed_version": "1.7.17-1ubuntu0.1~esm2",
      "applicability_unknown": true
    },
    {
      "name": "cjson",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.17-1ubuntu0.1~esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.7.16-1",
        "1.7.16-2",
        "1.7.17-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-31755",
      "fixed_version": "1.7.17-1ubuntu0.1~esm2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-31755",
      "provider_updated_at": "2026-04-22T14:48:52.406297Z",
      "applicability_unknown": true
    },
    {
      "name": "cJSON",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.18-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:14021-1",
      "fixed_version": "1.7.18-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:14021-1",
      "provider_updated_at": "2025-05-07T18:16:01.751977Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1071742]

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

[libcjson1]Inconnu
Paquet source: [cjson]
Détails (4)
- 1.7.15-1+deb12u4 · amd64 · bookworm
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
- 1.7.15-1+deb12u4 · arm64 · bookworm
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
- 1.7.15-1+deb12u4 · amd64 · bookworm-security
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
- 1.7.15-1+deb12u4 · arm64 · bookworm-security
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
[libcjson-dev]Inconnu
Paquet source: [cjson]
Détails (4)
- 1.7.15-1+deb12u4 · amd64 · bookworm
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
- 1.7.15-1+deb12u4 · arm64 · bookworm
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
- 1.7.15-1+deb12u4 · amd64 · bookworm-security
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12
- 1.7.15-1+deb12u4 · arm64 · bookworm-security
  Corrigée · Corrigée: 1.7.15-1+deb12u2
  usn · cjson · debian · bookworm; usn · cjson · debian · 12

[Debian 13 (Trixie)]

[libcjson1]Inconnu
Paquet source: [cjson]
Détails (4)
- 1.7.18-3.1+deb13u1 · amd64 · trixie
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
- 1.7.18-3.1+deb13u1 · arm64 · trixie
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
- 1.7.18-3.1+deb13u1 · amd64 · trixie-security
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
- 1.7.18-3.1+deb13u1 · arm64 · trixie-security
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
[libcjson-dev]Inconnu
Paquet source: [cjson]
Détails (4)
- 1.7.18-3.1+deb13u1 · amd64 · trixie
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
- 1.7.18-3.1+deb13u1 · arm64 · trixie
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
- 1.7.18-3.1+deb13u1 · amd64 · trixie-security
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13
- 1.7.18-3.1+deb13u1 · arm64 · trixie-security
  Corrigée · Corrigée: 1.7.18-1
  usn · cjson · debian · 13

[openSUSE Tumbleweed]

[cJSON-devel]Inconnu
Paquet source: [cJSON]
Détails (1)
- 1.7.19-3.2 · x86_64 · tumbleweed
  Inconnu · Corrigée: 1.7.18-1.1
  Version impact unknown
  usn · cJSON · opensuse · tumbleweed
[libcjson1]Inconnu
Paquet source: [cJSON]
Détails (1)
- 1.7.19-3.2 · x86_64 · tumbleweed
  Inconnu · Corrigée: 1.7.18-1.1
  Version impact unknown
  usn · cJSON · opensuse · tumbleweed
[libcjson1-32bit]Inconnu
Paquet source: [cJSON]
Détails (1)
- 1.7.19-3.2 · x86_64 · tumbleweed
  Inconnu · Corrigée: 1.7.18-1.1
  Version impact unknown
  usn · cJSON · opensuse · tumbleweed

Observé: Oct 28, 2026, 5:32:20 PM UTC

Références

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]