Denial of Service Vulnerability in libjettison-java: Stack Overflow Risk
Summary
CVE-2022-40149: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). Affects libjettison-java across 2 version ranges.
< 1.5.3-1~deb11u1
< 2b536fa46428bc7929aec8cb789f544337375593
Fixed in 1.5.3-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libjettison-java is a Java library used for parsing JSON and XML data. It is commonly utilized in applications that require data interchange between systems. The library is designed to be lightweight and efficient, making it a popular choice for developers. However, it has been found to be vulnerable to Denial of Service (DoS) attacks when processing untrusted input, which can lead to application crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2022-40149, arises when the Jettison parser processes untrusted XML or JSON data. An attacker can exploit this vulnerability by supplying specially crafted input that causes the parser to enter a stack overflow state, leading to a crash. This can result in a Denial of Service, rendering the application unavailable to legitimate users. The vulnerability affects multiple versions of the libjettison-java package across different Debian ecosystems.
How To Fix
Minimum fixed version
1.5.3-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjettison-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize and restrict the types of XML or JSON data that can be processed by the parser. This can help mitigate the risk of stack overflow by preventing malicious input from being parsed.
Conclusion
The CVE-2022-40149 vulnerability in libjettison-java poses a significant risk of Denial of Service attacks due to stack overflow when processing untrusted input. It is crucial for users of this library to update to the latest versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for libjettison-java →
FAQ
CVE-2022-40149 is a vulnerability in the libjettison-java library that can lead to Denial of Service attacks due to stack overflow when processing untrusted XML or JSON data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If an upgrade is not possible, implement input validation to sanitize the data being parsed to reduce the risk of exploitation.
More information about libjettison-java can be found on its GitHub repository at https://github.com/jettison-json/jettison.
Related vulnerabilities
Recent vulnerabilities recorded for libjettison-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
