GitHub Advisoryadvisory · Maven

GHSA-x27m-9w8j-5vcw Jettison memory exhaustion

HIGH Published 2022-09-17 Modified 2023-01-02 Official page ↗
Aliases
CVE-2022-40150
Ecosystem
Maven
Packages
org.codehaus.jettison:jettison
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-674
Reviewed
2022-09-20

Affected packages

• Maven org.codehaus.jettison:jettison: < 1.5.2 → fixed in 1.5.2

Description

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

Related

Alias · CVE (1)

  • CVE-2022-40150 Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-674 Uncontrolled Recursion weakness

References