Denial of Service Vulnerability in libjson-java Package
Summary
DEBIAN-CVE-2023-5072: Denial of Service in JSON-Java versions up to and including 20230618. Affects libjson-java versions < 3.1.0+dfsg-1. Fixed in 3.1.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libjson-java is a Java library that provides functionality for parsing and generating JSON data. It is widely used in applications that require data interchange in JSON format. The library is known for its ease of use and integration into Java projects, making it a popular choice among developers. However, it has been identified to have a vulnerability that can lead to excessive memory consumption under certain conditions.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2023-5072, is a Denial of Service (DoS) issue present in JSON-Java versions up to and including 20230618. The root cause of this vulnerability lies in a bug within the parser, which allows an input string of modest size to consume an indefinite amount of memory. This can lead to application crashes or unresponsive behavior, severely impacting the availability of services that rely on this library.
How To Fix
Minimum fixed version
3.1.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjson-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to validate and sanitize input strings before processing them with the libjson-java parser. This can help mitigate the risk of triggering the vulnerability until an update can be applied.
Conclusion
The libjson-java package has a critical Denial of Service vulnerability that can severely impact applications relying on it. It is essential to update to the latest patched version to ensure the security and stability of your applications. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for libjson-java →
FAQ
The vulnerability is a Denial of Service (DoS) issue that can lead to excessive memory consumption when processing certain input strings.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of libjson-java up to and including 20230618 are affected by this vulnerability.
If an immediate update is not possible, consider implementing input validation and sanitization as a temporary workaround.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5072.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjson-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
