Pj Fanning

Name of the Vulnerable Software and Affected Versions: Apache POI (affected versions not specified) Description: The issue concerns the parsing of OOXML based files, such as xlsx and docx, by the poi-ooxml component. It can read unexpected data if the underlying zip file has duplicate zip entry names. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Linkis versions 1.3.0 through 1.5.0 **Description** A Random string security vulnerability exists in Spark EngineConn, where the random string generated by the Token when starting Py4j uses Commons Lang's RandomStringUtils. **Recommendations** For Apache Linkis versions 1.3.0 through 1.5.0, upgrade to version 1.6.0 to fix this issue.

**Name of the Vulnerable Software and Affected Versions** Eclipse Parsson versions prior to 1.0.4 Eclipse Parsson versions prior to 1.1.3 **Description** A document with a large depth of nested objects can cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing JSON documents, including parsing, generating, transforming, and querying. **Recommendations** For Eclipse Parsson versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. For Eclipse Parsson versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Johnzon versions 1.2.0 through 1.2.20 **Description** A malicious attacker can craft JSON input that uses large numbers, such as `1e20000000`, which Apache Johnzon will deserialize into `BigDecimal`. This may result in a slow conversion, posing a denial of service risk. The issue is related to the deserialization of untrusted data and can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Apache Johnzon versions 1.2.0 through 1.2.20, update to Apache Johnzon 1.2.21, which mitigates this issue by setting a scale limit of 1000 to the `BigDecimal` by default. As a temporary workaround, consider restricting the use of large numbers in JSON input to minimize the risk of exploitation.