PT-2023-31622 · Atlassian+2 · Bitbucket Data Center/Server+8

Eamonnmcmanus · Publicado 2023-10-12 · Atualizado 2025-12-22 · CVE-2023-5072

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JSON-Java versions up to and including 20230618 Bitbucket Data Center and Server versions 7.17.0, 7.21.15, 8.9.4, 8.13.0, 8.14.0, and 8.15.0 Confluence Data Center and Server version 3.0 Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0

Description A denial of service vulnerability in JSON-Java was discovered. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. The issue is caused by the parser bug that can be used to circumvent a check that is supposed to prevent the key in a JSON object from itself being another JSON object. If a key does end up being a JSON object, then it gets converted into a string, using to escape special characters, including itself. This can lead to an exponential number of `` characters in the escaped string, causing a denial of service.

Recommendations For JSON-Java versions up to and including 20230618, upgrade to a version later than 20230618. For Bitbucket Data Center and Server versions 7.17.0, 7.21.15, 8.9.4, 8.13.0, 8.14.0, and 8.15.0, upgrade to the latest version or one of the specified supported fixed versions. For Confluence Data Center and Server version 3.0, upgrade to the latest version or one of the specified supported fixed versions. For Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0, upgrade to the latest version or one of the specified supported fixed versions. As a temporary workaround, consider disabling the use of JSON-Java until a patch is available.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Improperly Implemented Security Check for Standard

Enumeração de Fraquezas

CWE-770

CWE-358

Identificadores relacionados

CVE-2023-5072

GHSA-4JQ9-2XHW-JPX7

GHSA-RM7J-F5G5-27VV

Produtos afetados

Bamboo

Bamboo Data Center/Server

Bitbucket

Bitbucket Data Center/Server

Confluence

Confluence Data Center/Server

Debian

Jira

Red Os

Referências · 32

• 🔥 https://github.com/stleary/JSON-java/issues/771 · Exploit
• https://github.com/stleary/JSON-java/issues/758 · Nota
• https://github.com/stleary/JSON-java/pull/759 · Nota
• https://github.com/stleary/JSON-java · Nota
• https://github.com/stleary/JSON-java/commit/60662e2f8384d3449822a3a1179bfe8de67b55bb · Nota
• https://github.com/google/security-research/security/advisories/GHSA-4jq9-2xhw-jpx7 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-opensearch-cve-2023-5072 · Nota
• https://twitter.com/snyksec/status/1882603979571388817 · Publicação no Twitter
• https://t.me/cvenotify/63519 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-5072 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1712539666312843434 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2023-5072 · Nota de Segurança
• https://twitter.com/snyksec/status/1890473334992781761 · Publicação no Twitter
• https://github.com/stleary/JSON-java/pull/772 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/704074 · Nota de Segurança