GitHub Advisoryadvisory · Maven

GHSA-g8p6-p27c-52fx Eclipse Parsson Denial of Service vulnerability

MEDIUM Published 2023-11-03 Modified 2023-11-03 Official page ↗
Aliases
CVE-2023-4043
Ecosystem
Maven
Packages
org.eclipse.parsson:project
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-834
Reviewed
2023-11-03

Affected packages

• Maven org.eclipse.parsson:project: >= 1.1.0, < 1.1.4 → fixed in 1.1.4 • Maven org.eclipse.parsson:project: < 1.0.5 → fixed in 1.0.5

Description

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Related

Alias · CVE (1)

  • CVE-2023-4043 In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-834 Excessive Iteration weakness

References