GHSA-vc89-hccf-rq55 Hash collision in typelevel jawn

• Maven org.typelevel:jawn-parser_0.25: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parserg: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_0.27: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_2.10: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_2.11: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_2.12: < 1.3.2 → fixed in 1.3.2 • Maven org.typelevel:jawn-parser_2.13: < 1.3.2 → fixed in 1.3.2 • Maven org.typelevel:jawn-parser_2.13.0-M5: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_2.13.0-RC1: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_2.13.0-RC2: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_2.13.0-RC3: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_3: < 1.3.2 → fixed in 1.3.2 • Maven org.typelevel:jawn-parser_3.0.0-M1: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_3.0.0-M2: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_3.0.0-M3: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_3.0.0-RC1: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_3.0.0-RC2: < 1.3.2 (no fix yet) • Maven org.typelevel:jawn-parser_3.0.0-RC3: < 1.3.2 (no fix yet)

Impact Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: • `org.http4s` :: `http4s-play-json` • `org.typelevel :: jawn-ast` (= 0.8.0) • `org.typelevel :: jawn-json4s` (discontinued) • `org.typelevel :: jawn-argonaut` (discontinued) Patches `jawn-parser-1.3.2` fixes the issue. Workarounds Override `objectContext()` to use a collision-safe collection. See the patch for an example in both `SimpleFacade` and `MutableFacade`. References • https://github.com/typelevel/jawn/pull/390 Credits • @kag0, for the report and the patch For more information If you have any questions or comments about this advisory: • Open an issue in typelevel/jawn • E-mail a maintainer: • @rossabaker