search

vipinsun / cactus

Hyperledger Cactus is a new approach to the blockchain interoperability problem
https://wiki.hyperledger.org/display/cactus
Apache License 2.0
0 stars 1 forks source link

CVE-2023-33008 (Medium) detected in johnzon-core-1.1.11.jar #345

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2023-33008 - Medium Severity Vulnerability

Vulnerable Library - johnzon-core-1.1.11.jar

Apache Johnzon is an implementation of JSR-353 (JavaTM API for JSON Processing).

Library home page: https://www.apache.org/

Path to dependency file: /packages/cactus-plugin-ledger-connector-corda/src/main-server/kotlin/gen/kotlin-spring/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.johnzon/johnzon-core/1.1.11/8ccf8916cb8e3e9f7c7cb950f8f6d46ffe976605/johnzon-core-1.1.11.jar

Dependency Hierarchy: - corda-rpc-4.5.jar (Root Library) - corda-node-api-4.5.jar - artemis-core-client-2.8.0.jar - :x: **johnzon-core-1.1.11.jar** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.

Publish Date: 2023-07-07

URL: CVE-2023-33008

CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l

Release Date: 2023-07-07

Fix Resolution (org.apache.johnzon:johnzon-core): 1.2.21

Direct dependency fix Resolution (net.corda:corda-rpc): 4.12

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] commented 1 year ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.