ghsa-vc89-hccf-rq55
Vulnerability from github
Published
2022-01-06 23:48
Modified
2025-12-16 22:29
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Hash collision in typelevel jawn
Details

Impact

Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include: * org.http4s :: http4s-play-json * org.typelevel :: jawn-ast (< 0.8.0) * org.typelevel :: jawn-play (discontinued) * org.typelevel :: jawn-rojoma (discontinued) * org.typelevel :: jawn-spray (discontinued)

Unaffected implementations include: * io.argonaut :: argonaut-jawn * io.circe :: circe-parser * org.typelevel :: jawn-ast (>= 0.8.0) * org.typelevel :: jawn-json4s (discontinued) * org.typelevel :: jawn-argonaut (discontinued)

Patches

jawn-parser-1.3.2 fixes the issue.

Workarounds

Override objectContext() to use a collision-safe collection. See the patch for an example in both SimpleFacade and MutableFacade.

References

  • https://github.com/typelevel/jawn/pull/390

Credits

  • @kag0, for the report and the patch

For more information

If you have any questions or comments about this advisory: * Open an issue in typelevel/jawn * E-mail a maintainer: * @rossabaker

Show details on source website

To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_0.25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parserg"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_0.27"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.10"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.13.0-M5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.13.0-RC1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.13.0-RC2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_2.13.0-RC3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3.0.0-M1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3.0.0-M2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3.0.0-M3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3.0.0-RC1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3.0.0-RC2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.typelevel:jawn-parser_3.0.0-RC3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T20:19:30Z",
    "nvd_published_at": "2022-01-05T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nExtenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don\u0027t override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:\n\nAffected implementations include:\n* `org.http4s` :: `http4s-play-json`\n* `org.typelevel :: jawn-ast` (\u003c 0.8.0)\n* `org.typelevel :: jawn-play` (discontinued)\n* `org.typelevel :: jawn-rojoma` (discontinued)\n* `org.typelevel :: jawn-spray` (discontinued)\n\nUnaffected implementations include:\n* `io.argonaut :: argonaut-jawn`\n* `io.circe :: circe-parser`\n* `org.typelevel :: jawn-ast` (\u003e= 0.8.0)\n* `org.typelevel :: jawn-json4s` (discontinued)\n* `org.typelevel :: jawn-argonaut` (discontinued)\n\n### Patches\n\n`jawn-parser-1.3.2` fixes the issue.\n\n### Workarounds\n\nOverride `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.\n\n### References\n\n* https://github.com/typelevel/jawn/pull/390\n\n### Credits\n\n* @kag0, for the report and the patch\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)\n* E-mail a maintainer:\n  * [@rossabaker](mailto:ross@rossabaker.com)",
  "id": "GHSA-vc89-hccf-rq55",
  "modified": "2025-12-16T22:29:13Z",
  "published": "2022-01-06T23:48:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typelevel/jawn/pull/390"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/typelevel/jawn"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hash collision in typelevel jawn"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.