CVEvulnerability
CVE-2022-40150
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-09-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400, CWE-674
Description
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
Affected configurations
• jettison project jettison (<= 1.4.0)
• debian debian linux 10.0
• debian debian linux 11.0
Related
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549 Issue Tracking, Permissions Required, Third Party Advisory
- https://github.com/jettison-json/jettison/issues/45 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html Mailing List, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5312 Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549 Issue Tracking, Permissions Required, Third Party Advisory
- https://github.com/jettison-json/jettison/issues/45 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html Mailing List, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5312 Third Party Advisory