Most recent entries from all

certfr-2024-avi-0046 — De multiples vulnérabilités ont été découvertes dans Oracle Java SE. Elles permettent à un attaquant de provoquer un dé…

certfr-2024-avi-0046

EUVD-2026-216978

fkie_cve-2023-5072

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

GHSA-4jq9-2xhw-jpx7 — Java: DoS Vulnerability in JSON-JAVA

Affected: Maven: org.json:json

### Summary A denial of service vulnerability in JSON-Java was discovered by [ClusterFuzz](https://google.github.io/clusterfuzz/). A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. There are two issues: (1) the parser bug can be used to circumvent a check that is supposed to prevent the key in a JSON object from itself being another JSON object; (2) if a key does end up being a JSON object then it gets converted into a string, using `\` to escape special characters, including `\` itself. So by nesting JSON objects, with a key that is a JSON object that has a key that is a JSON object, and so on, we can get an exponential number of `\` characters in the escaped string.

### Severity High - Because this is an already-fixed DoS vulnerability, the only remaining impact possible is for existing binaries that have not been updated yet.

### Proof of Concept ```java package orgjsonbug;

import org.json.JSONObject;

/** * Illustrates a bug in JSON-Java. */ public class Bug { private static String makeNested(int depth) { if (depth == 0) { return "{\"a\":1}"; } return "{\"a\":1;\t\0" + makeNested(depth - 1) + ":1}"; }

public static void main(String[] args) { String input = makeNested(30); System.out.printf("Input string has length %d: %s\n", input.length(), input); JSONObject output = new JSONObject(input); System.out.printf("Output JSONObject has length %d: %s\n", output.toStr…

gsd-2023-5072

RHSA-2023:7617 — Red Hat Security Advisory: Red Hat Build of Apache Camel for Quarkus 3.2.0 release (RHBQ 3.2.9.Final)

JSON-java: parser confusion leads to OOM apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

UBUNTU-CVE-2023-5072

Affected: Ubuntu:16.04:LTS: jenkins-json, Ubuntu:Pro:16.04:LTS: libjettison-java, Ubuntu:16.04:LTS: libjson-java, Ubuntu:18.04:LTS: jenkins-json, Ubuntu:Pro:18.04:LTS: libjettison-java, Ubuntu:18.04:LTS: libjson-java, Ubuntu:20.04:LTS: jenkins-json, Ubuntu:Pro:20.04:LTS: libjettison-java, Ubuntu:20.04:LTS: libjson-java, Ubuntu:22.04:LTS: jenkins-json and 11 more

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

WID-SEC-W-2023-3037 — Apache Camel: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.