Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14MjdtLTl3OGotNXZjd84AAu50

Jettison memory exhaustion

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

Permalink: https://github.com/advisories/GHSA-x27m-9w8j-5vcw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14MjdtLTl3OGotNXZjd84AAu50
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 10 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-x27m-9w8j-5vcw, CVE-2022-40150
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-40150
• https://github.com/jettison-json/jettison/issues/45
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549
• https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html
• https://www.debian.org/security/2023/dsa-5312
• https://github.com/advisories/GHSA-x27m-9w8j-5vcw

Repository: https://github.com/jettison-json/jettison
Blast Radius: 29.9

Affected Packages