Denial of Service Vulnerability in json-smart Package
Summary
DEBIAN-CVE-2024-57699: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. Affects json-smart versions < 2.5.2-1. Fixed in 2.5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-smart package is a Java library designed for parsing and generating JSON data. It is widely used in applications that require efficient handling of JSON, providing features such as streaming and tree model parsing. However, versions 2.5.0 through 2.5.1 of json-smart are vulnerable to a Denial of Service (DoS) attack due to improper handling of specially crafted JSON inputs.
Vulnerability Detail
A security issue was identified in the json-smart package, specifically in versions 2.5.0 through 2.5.1. The vulnerability arises when the library processes a JSON input containing a large number of opening braces '{'. This can lead to stack exhaustion, potentially allowing an attacker to crash the application, resulting in a Denial of Service (DoS). This issue is a consequence of an incomplete fix for CVE-2023-1370, which highlights the importance of thorough testing and validation of input data.
How To Fix
Minimum fixed version
2.5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade json-smartTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted JSON inputs that may contain a large number of opening braces '{'. Implement input validation to limit the size and complexity of JSON data being processed.
Conclusion
The json-smart package has a critical vulnerability that can lead to Denial of Service when processing specially crafted JSON inputs. It is essential to update to the patched version 2.5.2-1 to mitigate this risk. Additionally, employing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for json-smart →
FAQ
Versions 2.5.0 through 2.5.1 of json-smart are affected by this vulnerability.
The vulnerability can lead to Denial of Service (DoS), causing applications using the affected versions to crash when processing malicious JSON inputs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability is fixed in version 2.5.2-1 of the json-smart package.
If an immediate update is not possible, implement input validation to restrict the processing of potentially malicious JSON data.
References
Related vulnerabilities
Recent vulnerabilities recorded for json-smart.
