Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
References
| Link | Resource |
|---|---|
| https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538 | Permissions Required Third Party Advisory |
| https://github.com/jettison-json/jettison/issues/45 | Issue Tracking Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html | Mailing List Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5312 | Third Party Advisory |
Configurations
History
01 Mar 2023, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
22 Dec 2022, 20:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html - Mailing List, Third Party Advisory |
10 Nov 2022, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| References |
|
|
| References | (CONFIRM) https://github.com/jettison-json/jettison/issues/45 - Issue Tracking, Third Party Advisory | |
| References | (CONFIRM) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538 - Permissions Required, Third Party Advisory | |
| CPE | cpe:2.3:a:jettison_project:jettison:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
16 Sep 2022, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-16 10:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-40149
Mitre link : CVE-2022-40149
CVE.ORG link : CVE-2022-40149
JSON object : View
Products Affected
debian
- debian_linux
jettison_project
- jettison