github - ghsa-crqg-jrpj-fc84

ghsa-crqg-jrpj-fc84

Vulnerability from github

Published

2023-07-07 12:30

Modified

2023-07-14 19:41

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Apache Johnzon Deserialization of Untrusted Data vulnerability

Details

A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal.

This issue affects Apache Johnzon through 1.2.20.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.johnzon:johnzon-mapper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-33008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-07T18:32:03Z",
    "nvd_published_at": "2023-07-07T10:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A malicious attacker can craft up some JSON input that uses large numbers (numbers such as\u00a01e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. \n\n\nThis issue affects Apache Johnzon through 1.2.20.\n\n",
  "id": "GHSA-crqg-jrpj-fc84",
  "modified": "2023-07-14T19:41:32Z",
  "published": "2023-07-07T12:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/johnzon/commit/34ad9a6b296ae7b4667c3cf0037998e451499ea4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/johnzon"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/JOHNZON-397"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Johnzon Deserialization of Untrusted Data vulnerability"
}

cve-2023-33008

Vulnerability from cvelistv5

Published

2023-07-07 09:07

Modified

2024-10-07 19:13

Severity ?

Summary

Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

References

▼	URL	Tags
	https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

Apache Johnzon

Version: 0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:32:46.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:johnzon:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "johnzon",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "1.2.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-33008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-07T19:06:08.762662Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-07T19:13:58.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Apache Johnzon",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.2.20",
              "status": "affected",
              "version": "0",
              "versionType": "1.2.21"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "PJ Fanning"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jean-Louis Monteiro"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Romain Manni-Bucau"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eDeserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.\u003cbr\u003e\u003c/div\u003e\u003cp\u003eA malicious attacker can craft up some JSON input that uses large numbers (numbers such as\u0026nbsp;1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. \u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache Johnzon: through 1.2.20.\u003c/p\u003e"
            }
          ],
          "value": "Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.\n\n\nA malicious attacker can craft up some JSON input that uses large numbers (numbers such as\u00a01e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. \n\n\nThis issue affects Apache Johnzon: through 1.2.20.\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-07T09:07:31.070Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l"
        }
      ],
      "source": {
        "defect": [
          "JOHNZON-397"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-33008",
    "datePublished": "2023-07-07T09:07:31.070Z",
    "dateReserved": "2023-05-16T12:48:35.689Z",
    "dateUpdated": "2024-10-07T19:13:58.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted