CVE-2023-5072

Name
CVE-2023-5072
Description
Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/stleary/JSON-java/issues/771
MISC https://github.com/stleary/JSON-java/issues/758
cve-coordination@google.com http://www.openwall.com/lists/oss-security/2023/12/13/4
cve-coordination@google.com https://security.netapp.com/advisory/ntap-20240621-0007/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:json-java_project:json-java:*:*:*:*:*:*:*:* json-java >= None <= 20230618

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openjdk21 edge-community 21.0.2_p13-r0 None fixed
openjdk21 3.22-community 21.0.2_p13-r0 None fixed
openjdk21 3.21-community 21.0.2_p13-r0 None fixed
openjdk21 3.20-community 21.0.2_p13-r0 None fixed
openjdk21 3.19-community 21.0.2_p13-r0 Simon Frankenberger <simon-alpine@fraho.eu> fixed
openjdk17 edge-community 17.0.10_p7-r0 Simon Frankenberger <simon-alpine@fraho.eu> fixed
openjdk17 3.22-community 17.0.10_p7-r0 None fixed
openjdk17 3.21-community 17.0.10_p7-r0 None fixed
openjdk17 3.20-community 17.0.10_p7-r0 None fixed
openjdk17 3.19-community 17.0.10_p7-r0 Simon Frankenberger <simon-alpine@fraho.eu> fixed