PT-2023-27449 · Eclipse · Eclipse Parsson

Marta Rybczynska + 1 · Publicado 2023-11-03 · Atualizado 2023-11-13 · CVE-2023-4043

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Parsson versions prior to 1.1.4 Eclipse Parsson versions prior to 1.0.5

Description Parsing JSON from untrusted sources can lead to exploitation due to edge cases in Java's built-in support for parsing numbers with large scales, resulting in unexpectedly large processing times.

Recommendations For Eclipse Parsson versions prior to 1.1.4, update to version 1.1.4 or later to mitigate the risk. For Eclipse Parsson versions prior to 1.0.5, update to version 1.0.5 or later to mitigate the risk.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-834

CWE-20

Identificadores relacionados

CVE-2023-4043

GHSA-G8P6-P27C-52FX

RHSA-2024:1192

RHSA-2024:1193

Produtos afetados

Eclipse Parsson

Referências · 6

• 🔥 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13 · Exploit
• https://github.com/eclipse-ee4j/parsson/pull/100 · Correção
• https://twitter.com/CVEnew/status/1720359774032928932 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-g8p6-p27c-52fx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-4043 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4043 · Nota de Segurança