Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2023-5072 (High) detected in json-20230618.jar - autoclosed #3522

Closed
mend-for-github-com bot opened this issue Oct 18, 2023 · 1 comment
Closed

CVE-2023-5072 (High) detected in json-20230618.jar - autoclosed #3522

mend-for-github-com bot opened this issue Oct 18, 2023 · 1 comment
Assignees
@dlvenable
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Milestone
v2.6

Comments

@mend-for-github-com
Copy link
Contributor

mend-for-github-com bot commented Oct 18, 2023 •
edited
Loading

CVE-2023-5072 - High Severity Vulnerability

Vulnerable Library - json-20230618.jar

JSON is a light-weight, language independent, data interchange format. See http://www.JSON.org/ 

    The files in this package implement JSON encoders/decoders in Java.
    It also includes the capability to convert between JSON and XML, HTTP
    headers, Cookies, and CDL.

    This is a reference implementation. There is a large number of JSON packages
    in Java. Perhaps someday the Java community will standardize on one. Until
    then, choose carefully.</p>

Path to dependency file: /data-prepper-plugins/kafka-plugins/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20230618/1ae16df7d556d02713e241086f878399e99260d6/json-20230618.jar

Dependency Hierarchy:

  • anomaly-detector-processor-2.6.0-SNAPSHOT (Root Library)
    • ❌ json-20230618.jar (Vulnerable Library)

Found in HEAD commit: 5b822f31bcf20d963c76d9b2319604252b9fa5d1

Found in base branch: main

Vulnerability Details

Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. 

Publish Date: 2023-10-12

URL: CVE-2023-5072

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rm7j-f5g5-27vv

Release Date: 2023-10-12

Fix Resolution: org.json:json:20231013
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label Oct 18, 2023
@dlvenable dlvenable added this to the v2.6 milestone Oct 24, 2023
@dlvenable dlvenable self-assigned this Oct 24, 2023
dlvenable added a commit to dlvenable/data-prepper that referenced this issue Nov 21, 2023
@dlvenable
Updates the opensearch-java client to 2.8.1 and opensearch to 1.3.13.…
79cda55 
… This includes a transitive dependency update to parsson to resolve CVE-2023-4043.

Update required version of org.json library to resolve CVE-2023-5072. Require a Zookeeper version which resolves CVE-2023-44981. Require a transitive Scala library to resolve CVE-2023-46122.

Resolves opensearch-project#3588, opensearch-project#3522, opensearch-project#3491, opensearch-project#3547

Signed-off-by: David Venable <[email protected]>
@dlvenable dlvenable mentioned this issue Nov 21, 2023
Merged
4 tasks
dlvenable added a commit that referenced this issue Nov 27, 2023
@dlvenable
Updates the opensearch-java client to 2.8.1 and opensearch to 1.3.13.…
37e18a5 
… This includes a transitive dependency update to parsson to resolve CVE-2023-4043. (#3689)

Update required version of org.json library to resolve CVE-2023-5072. Require a Zookeeper version which resolves CVE-2023-44981. Require a transitive Scala library to resolve CVE-2023-46122.

Resolves #3588, #3522, #3491, #3547

Signed-off-by: David Venable <[email protected]>
@mend-for-github-com mend-for-github-com bot changed the title CVE-2023-5072 (High) detected in json-20230618.jar CVE-2023-5072 (High) detected in json-20230618.jar - autoclosed Nov 27, 2023
@mend-for-github-com Mend for GitHub.com
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@github-project-automation github-project-automation bot moved this from Unplanned to Done in Data Prepper Tracking Board Nov 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dlvenable dlvenable

Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Projects
Data Prepper Tracking Board
Archived in project
Milestone
v2.6
Development

No branches or pull requests
1 participant
@dlvenable