CVE-2023-1370

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-1370
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1370.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-1370
Aliases
Related
Published
2023-03-22T06:15:09Z
Modified
2024-06-21T22:30:31.768572Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Json-smart is a performance focused, JSON processor lib.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.

It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

References

Affected packages

Git / github.com/netplex/json-smart-v2

Affected ranges

Type
GIT
Repo
https://github.com/netplex/json-smart-v2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

2.*

2.2
2.4.1
2.4.5
2.4.8