CVE-2023-5072: Java: DoS Vulnerability in JSON-JAVA
(updated )
A denial of service vulnerability in JSON-Java was discovered by ClusterFuzz. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. There are two issues: (1) the parser bug can be used to circumvent a check that is supposed to prevent the key in a JSON object from itself being another JSON object; (2) if a key does end up being a JSON object then it gets converted into a string, using \ to escape special characters, including \ itself. So by nesting JSON objects, with a key that is a JSON object that has a key that is a JSON object, and so on, we can get an exponential number of \ characters in the escaped string.
References
- github.com/advisories/GHSA-4jq9-2xhw-jpx7
- github.com/google/security-research/security/advisories/GHSA-4jq9-2xhw-jpx7
- github.com/stleary/JSON-java
- github.com/stleary/JSON-java/commit/60662e2f8384d3449822a3a1179bfe8de67b55bb
- github.com/stleary/JSON-java/issues/758
- github.com/stleary/JSON-java/issues/771
- github.com/stleary/JSON-java/pull/759
- nvd.nist.gov/vuln/detail/CVE-2023-5072
Code Behaviors & Features
Detect and mitigate CVE-2023-5072 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →