Vulnerability on json-iterator (CVE-2021-23441)

json-iterator / go

A high-performance 100% compatible drop-in replacement of "encoding/json"

http://jsoniter.com/migrate-from-go-std.html

MIT License

13.34k stars 1.02k forks source link

Vulnerability on json-iterator (CVE-2021-23441) #581

Open msantosfelipe opened 2 years ago

msantosfelipe commented 2 years ago

I have a vulnerability issue in my code caused by the lib json-iterator All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23441

yusufozturk commented 2 years ago

Apparently it's no longer considered as vulnerability, because CVE is rejected.

Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.