GHSA-rg2c-cfxv-qp6f

Source

https://github.com/advisories/GHSA-rg2c-cfxv-qp6f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-rg2c-cfxv-qp6f/GHSA-rg2c-cfxv-qp6f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rg2c-cfxv-qp6f

Aliases

CVE-2023-3894

Published

2023-08-08T18:30:37Z

Modified

2024-02-16T08:19:29.730921Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVSS Calculator

Summary

Denial of service in jackson-dataformats-text

Details

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Database specific

{
    "nvd_published_at": "2023-08-08T18:15:24Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-400",
        "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-09T12:52:21Z"
}

References

Affected packages

Maven / com.fasterxml.jackson.dataformat:jackson-dataformats-text

Package

Name: com.fasterxml.jackson.dataformat:jackson-dataformats-text; View open source insights on deps.dev
Purl: pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformats-text

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.15.0

Affected versions

2.*

2.9.0

2.9.0.pr2

2.9.0.pr3

2.9.0.pr4

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.9.6

2.9.7

2.9.8

2.9.9

2.9.10

2.10.0

2.10.0.pr1

2.10.0.pr2

2.10.0.pr3

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.11.0.rc1

2.11.0

2.11.1

2.11.2

2.11.3

2.11.4

2.12.0-rc1

2.12.0-rc2

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.12.5

2.12.6

2.12.7

2.13.0-rc1

2.13.0-rc2

2.13.0

2.13.1

2.13.2

2.13.3

2.13.4

2.13.5

2.14.0-rc1

2.14.0-rc2

2.14.0-rc3

2.14.0

2.14.1

2.14.2

2.14.3

2.15.0-rc1

2.15.0-rc2

2.15.0-rc3