GitHub Advisoryadvisory · Maven

GHSA-gcg6-xv4f-f749 janino vulnerable to denial of service due to stack overflow

MEDIUM Published 2023-06-01 Modified 2023-06-09 Official page ↗
Aliases
CVE-2023-33546
Ecosystem
Maven
Packages
org.codehaus.janino:janino-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-787
Reviewed
2023-06-06

Affected packages

• Maven org.codehaus.janino:janino-parent: <= 3.1.9 (no fix yet)

Description

janino 3.1.9 and earlier is subject to denial of service (DOS) attacks when using the expression `evaluator.guess` parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.

Related

Alias · CVE (1)

  • CVE-2023-33546 Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References