Denial of Service Vulnerability in Jettison (libjettison-java) Due to Stack Overflow
Summary
CVE-2022-45685: A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. Affects libjettison-java across 2 version ranges.
< 1.5.3-1~deb11u1
< 6dc73a07ac47c7e3b4c7d041761fbc11aee2eb50
Fixed in 1.5.3-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jettison is a Java library used for converting between JSON and XML formats. It is widely utilized in applications that require data interchange between these two formats. The library is known for its lightweight design and ease of use. However, a vulnerability has been identified in versions prior to 1.5.2, which allows attackers to exploit crafted JSON data, leading to a stack overflow and potential Denial of Service (DoS) conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2022-45685, arises from a stack overflow in Jettison before version 1.5.2. Attackers can exploit this vulnerability by sending specially crafted JSON data to the application using the library. This can lead to a Denial of Service (DoS), where the application becomes unresponsive or crashes. The vulnerability has a CVSS score of 7.5, indicating a high severity level, and it affects multiple Debian ecosystems, including versions 11, 12, and 13.
How To Fix
Minimum fixed version
1.5.3-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjettison-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize JSON data before processing it. This can help mitigate the risk of stack overflow by rejecting malformed or overly complex JSON structures.
Conclusion
The CVE-2022-45685 vulnerability in the Jettison library poses a significant risk of Denial of Service due to stack overflow. Users are strongly advised to upgrade to version 1.5.3 or later to protect their applications. Implementing input validation can serve as a temporary workaround while awaiting an upgrade.
See every vulnerability recorded for libjettison-java →
FAQ
CVE-2022-45685 is a vulnerability in the Jettison library that allows attackers to cause a Denial of Service through crafted JSON data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, implement input validation to sanitize JSON data and mitigate the risk of stack overflow.
More information about Jettison can be found on its GitHub repository at https://github.com/jettison-json/jettison.
Related vulnerabilities
Recent vulnerabilities recorded for libjettison-java.
