GitHub Advisoryadvisory · Maven

GHSA-c4pm-63cg-9j7h Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List

HIGH Published 2022-12-08 Modified 2025-01-17 Official page ↗
Aliases
CVE-2022-23496
Ecosystem
Maven
Packages
nl.basjes.parse.useragent:yauaa, nl.basjes.parse.useragent:yauaa-beam, nl.basjes.parse.useragent:yauaa-beam-sql, nl.basjes.parse.useragent:yauaa-drill, nl.basjes.parse.useragent:yauaa-elasticsearch, nl.basjes.parse.useragent:yauaa-elasticsearch-8, nl.basjes.parse.useragent:yauaa-flink, nl.basjes.parse.useragent:yauaa-flink-table, nl.basjes.parse.useragent:yauaa-hive, nl.basjes.parse.useragent:yauaa-logparser, nl.basjes.parse.useragent:yauaa-snowflake, nl.basjes.parse.useragent:yauaa-trino
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-755
Reviewed
2022-12-08

Affected packages

• Maven nl.basjes.parse.useragent:yauaa: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-beam: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-beam-sql: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-drill: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-elasticsearch: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-elasticsearch-8: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-flink: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-flink-table: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-hive: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-logparser: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-snowflake: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven nl.basjes.parse.useragent:yauaa-trino: >= 7.0.0, < 7.9.0 → fixed in 7.9.0

Description

Impact Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. Applications that do not use this feature are not affected. Patches Upgrade to 7.9.0 Workarounds Catch and discard any exceptions from Yauaa.

Related

Alias · CVE (1)

  • CVE-2022-23496 Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant… vulnerability

Weakness · CWE (1)

  • CWE-755 Improper Handling of Exceptional Conditions weakness

References