Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01NmgzLTc4Z3Atdjgzcs4AAu5k

Jettison parser crash by stackoverflow

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Permalink: https://github.com/advisories/GHSA-56h3-78gp-v83r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01NmgzLTc4Z3Atdjgzcs4AAu5k
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: almost 2 years ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00465
EPSS Percentile: 0.76227

Identifiers: GHSA-56h3-78gp-v83r, CVE-2022-40149
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-40149
• https://github.com/jettison-json/jettison/issues/45
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538
• https://github.com/jettison-json/jettison/pull/49/files
• https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1
• https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html
• https://www.debian.org/security/2023/dsa-5312
• https://github.com/advisories/GHSA-56h3-78gp-v83r

Repository: https://github.com/jettison-json/jettison
Blast Radius: 25.9

Affected Packages