GHSA-crqg-jrpj-fc84

Suggest an improvement
Source
https://github.com/advisories/GHSA-crqg-jrpj-fc84
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-crqg-jrpj-fc84/GHSA-crqg-jrpj-fc84.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-crqg-jrpj-fc84
Aliases
Published
2023-07-07T12:30:22Z
Modified
2023-11-10T05:55:16.554712Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Apache Johnzon Deserialization of Untrusted Data vulnerability
Details

A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal.

This issue affects Apache Johnzon through 1.2.20.

Database specific
{
    "nvd_published_at": "2023-07-07T10:15:09Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-07T18:32:03Z"
}
References

Affected packages

Maven / org.apache.johnzon:johnzon-mapper

Package

Name
org.apache.johnzon:johnzon-mapper
View open source insights on deps.dev
Purl
pkg:maven/org.apache.johnzon/johnzon-mapper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.21

Affected versions

0.*

0.1-incubating
0.2-incubating
0.5-incubating
0.6-incubating
0.7-incubating
0.8-incubating
0.9-incubating
0.9.1-incubating
0.9.2-incubating
0.9.3-incubating
0.9.4
0.9.5

1.*

1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.1.12
1.1.13
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.17
1.2.18
1.2.19
1.2.20