CVE-2022-3433: Hash flooding vulnerability in aeson
Summary
CVE-2022-3433: Hash flooding vulnerability in aeson. Affects aeson versions >= 0.4.0.0, < 2.0.1.0. Fixed in 2.0.1.0. How to fix ↓
Also tracked for
- haskell-aeson · Debian:11
The same CVE-2022-3433 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aeson package is a popular JSON parsing and encoding library in the Haskell ecosystem. It provides a simple and efficient way to work with JSON data in Haskell applications. However, versions prior to 2.0.1.0 are vulnerable to a hash flooding (hash DoS) attack. This vulnerability is a consequence of the HashMap implementation from unordered-containers and can result in a denial of service by consuming excessive CPU resources. Hash flooding attacks have been used against various languages, libraries, and frameworks in the past.
Vulnerability Detail
The hash flooding vulnerability in aeson allows an attacker to exploit the HashMap implementation and cause a denial of service by consuming excessive CPU resources. By crafting specially designed JSON payloads, an attacker can trigger hash collisions, leading to a significant increase in the time required to perform hash table operations. This can result in a severe degradation of performance and potentially render the affected application unresponsive. This vulnerability has been assigned the CVE identifier CVE-2022-3433.
How To Fix
Minimum fixed version
2.0.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to a patched version of the aeson package.
Conclusion
The hash flooding vulnerability in aeson can be mitigated by upgrading to version 2.0.1.0 or later. It is crucial for developers to promptly update their dependencies and rebuild their applications to ensure they are using the patched version of aeson. Regularly updating dependencies is also recommended to stay protected against known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aeson →
FAQ
The vulnerability can lead to a denial of service by consuming excessive CPU resources, potentially rendering the affected application unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
No, only versions prior to 2.0.1.0 are vulnerable to this hash flooding vulnerability. It is recommended to upgrade to the latest patched version to mitigate the risk.
While there are no known public exploits targeting this specific vulnerability in aeson, hash flooding attacks have been used against various libraries and frameworks in the past. It is crucial to apply the fix to protect against potential attacks.
If upgrading to the latest version of aeson is not feasible, consider implementing additional security measures such as rate limiting or request validation to mitigate the risk of hash flooding attacks.
Related vulnerabilities
Recent vulnerabilities recorded for aeson.
