GHSA-xqcq-j8w9-3pxv

Source

https://github.com/advisories/GHSA-xqcq-j8w9-3pxv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-xqcq-j8w9-3pxv/GHSA-xqcq-j8w9-3pxv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xqcq-j8w9-3pxv

Published

2023-08-01T19:53:16Z

Modified

2023-08-01T19:53:16Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Jettison parser crash by stackoverflow

Details

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-40149
https://github.com/jettison-json/jettison/issues/45
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538
https://github.com/jettison-json/jettison/pull/49/files
https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1
https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html
https://www.debian.org/security/2023/dsa-5312

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-121",
        "CWE-787"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-01T19:53:16Z"
}

References

Affected packages

Maven / com.tencyle.fixes:org.codehaus.jettison--jettison

Package

Name: com.tencyle.fixes:org.codehaus.jettison--jettison; View open source insights on deps.dev
Purl: pkg:maven/com.tencyle.fixes/org.codehaus.jettison--jettison

Affected ranges

Affected versions

1.*

1.1-tencyle-2.1.0