GHSA-q6g2-g7f3-rr83
Jettison vulnerable to infinite recursion
At a glance
- Published
- Updated
- CVE
- CVE-2023-1436
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.codehaus.jettison:jettison | introduced 0, fixed 1.5.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-1436 ADVISORY
- https://github.com/jettison-json/jettison/issues/60 WEB
- https://github.com/jettison-json/jettison/pull/62 WEB
- https://github.com/jettison-json/jettison PACKAGE
- https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.4 WEB
- https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |