Infinite Recursion Vulnerability in libjettison-java Package
Summary
DEBIAN-CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. Affects libjettison-java versions < 1.5.4-1. Fixed in 1.5.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjettison-java is a Java library used for converting Java objects to JSON and vice versa. It is commonly utilized in applications that require JSON serialization and deserialization. This package is essential for developers who need to handle JSON data efficiently. However, it is vulnerable to a specific issue that can lead to application crashes due to infinite recursion when self-referencing collections are processed.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-1436 arises from an infinite recursion triggered in the Jettison library when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This flaw can result in a StackOverflowError exception being thrown, potentially causing applications to crash or behave unpredictably. The issue is particularly critical in environments where JSON data structures are dynamically generated and may include self-references.
How To Fix
Minimum fixed version
1.5.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjettison-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using self-referencing collections when constructing JSON arrays with libjettison-java. If self-references are necessary, consider implementing a custom serialization strategy to handle such cases without triggering recursion.
Conclusion
The libjettison-java package has a critical vulnerability that can lead to application crashes due to infinite recursion when handling self-referencing collections. It is essential to update to the patched version 1.5.4-1 to ensure application stability and security. Additionally, using tools like Vulert can help monitor for such vulnerabilities in your software.
See every vulnerability recorded for libjettison-java →
FAQ
The vulnerability is an infinite recursion issue that occurs when a JSONArray is constructed from a Collection containing self-references, leading to a StackOverflowError.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to Vulert's playground, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability can cause applications to crash due to StackOverflowError, leading to service disruptions and potential data loss.
Yes, the issue is resolved in version 1.5.4-1 of libjettison-java. Updating to this version will mitigate the vulnerability.
If immediate updates are not possible, avoid using self-referencing collections in your JSON data structures as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjettison-java.
