Denial of Service Vulnerability in libmjson-java: CVE-2023-34611
Summary
UBUNTU-CVE-2023-34611: An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. Affects libmjson-java versions 1.4.0-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libmjson-java is a Java library designed for parsing and manipulating JSON data. It provides a simple interface for developers to work with JSON objects and arrays. However, the library has been found to be vulnerable to a denial of service attack due to its handling of cyclic dependencies in JSON objects, which can lead to resource exhaustion.
Vulnerability Detail
An issue was discovered in mjson through version 1.4.1 that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that utilize cyclic dependencies. This vulnerability can lead to excessive resource consumption, potentially crashing applications that rely on this library. The vulnerability is identified as CVE-2023-34611 and has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using JSON objects with cyclic dependencies in your application until the package is updated. This can help mitigate the risk of denial of service attacks.
Conclusion
The libmjson-java library has a critical vulnerability (CVE-2023-34611) that can lead to denial of service through crafted JSON objects. It is essential to update to a patched version to protect applications from potential attacks. Users can also utilize Vulert to monitor vulnerabilities in their software.
See every vulnerability recorded for libmjson-java →
FAQ
CVE-2023-34611 is a vulnerability found in libmjson-java that allows attackers to exploit cyclic dependencies in JSON objects, leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to denial of service, causing applications to crash or become unresponsive due to excessive resource consumption.
Yes, a patched version of libmjson-java is available. It is recommended to update to a version greater than 1.4.1.
If you cannot update the package, avoid using JSON objects with cyclic dependencies as a temporary workaround to mitigate the risk.
