linkedin / cruise-control

Cruise-control is the first of its kind to fully automate the dynamic workload rebalance and self-healing of a Kafka cluster. It provides great value to Kafka users by simplifying the operation of Kafka clusters.
https://github.com/linkedin/cruise-control/tags
BSD 2-Clause "Simplified" License
2.74k stars 585 forks source link

Upgrade org.json to 20231013+ due to CVE-2023-5072 #2073

Closed egyedt closed 11 months ago

egyedt commented 11 months ago

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

CVSSv3 Score:- 7.5(High)

Affected Version:- upto 20230618(excluding)

https://nvd.nist.gov/vuln/detail/CVE-2023-5072