CVE-2023-34620: hjson stack exhaustion vulnerability
Summary
CVE-2023-34620: hjson stack exhaustion vulnerability. Affects org.hjson:hjson versions < 3.0.0. No fix is published. How to fix ↓
Also tracked for
The same CVE-2023-34620 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hjson package is a JSON parser and serializer for the Java programming language. It provides a simple and efficient way to work with JSON data. The package is widely used in Maven projects for handling JSON data. However, versions up to 3.0.0 of the hjson package are vulnerable to a stack exhaustion vulnerability.
Vulnerability Detail
The hjson package through version 3.0.0 is susceptible to a stack exhaustion vulnerability. Attackers can exploit this vulnerability by providing crafted objects with deeply nested structures. This can lead to a denial of service or other unspecified impacts. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a fixed version of the hjson package to mitigate the risk.
Conclusion
The hjson package up to version 3.0.0 is vulnerable to a stack exhaustion vulnerability, which can result in a denial of service or other impacts. To mitigate this risk, it is crucial to upgrade the hjson package to a version higher than 3.0.0. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.hjson:hjson →
FAQ
The vulnerability can result in a denial of service or other unspecified impacts. It can potentially disrupt the normal functioning of the affected application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to upgrade the hjson package to a version higher than 3.0.0.
No, there are no known workarounds for this vulnerability. Upgrading to a fixed version of the hjson package is the recommended solution.
For more information about this vulnerability, you can refer to the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-5wfc-hjrc-gq87/GHSA-5wfc-hjrc-gq87.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.hjson:hjson.
