Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04ajI4LTM0cXEtZ21jaM4AAzU2

Apache Sling Commons JSON bundle vulnerable to Improper Input Validation

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.

Permalink: https://github.com/advisories/GHSA-8j28-34qq-gmch
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04ajI4LTM0cXEtZ21jaM4AAzU2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: 6 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-8j28-34qq-gmch, CVE-2022-47937
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-47937
• https://github.com/apache/sling-org-apache-sling-commons-johnzon
• https://issues.apache.org/jira/browse/SLING-6536
• https://lists.apache.org/thread/sws7z50x47gv0c38q4kx6ktqrvrrg1pm
• http://www.openwall.com/lists/oss-security/2023/05/15/2
• https://www.openwall.com/lists/oss-security/2023/05/15/2
• https://github.com/advisories/GHSA-8j28-34qq-gmch

Repository: https://github.com/apache/sling-org-apache-sling-commons-johnzon
Blast Radius: 28.6

Affected Packages