PT-2021-6276 · Netplex · Netplex Json-Smart-V2+1

Published 2021-02-23 · Updated 2023-02-15 · CVE-2021-27568

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions netplex json-smart-v1 versions through 2015-10-23 netplex json-smart-v2 versions through 2.4

Description An issue was discovered where an exception is thrown from a function but not caught, as demonstrated by NumberFormatException. This may cause programs using the library to crash or expose sensitive information. The vulnerability is related to insufficient checking of unusual or exceptional states, which could allow a remote attacker to cause the application to crash or disclose protected information.

Recommendations For netplex json-smart-v1 versions through 2015-10-23, consider updating to a version after 2015-10-23 to resolve the issue. For netplex json-smart-v2 versions through 2.4, consider updating to a version after 2.4 to resolve the issue. As a temporary workaround, consider implementing exception handling for NumberFormatException to prevent program crashes and information exposure.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2022-01228

CVE-2021-27568

GHSA-V528-7HRM-FRQP

Affected Products

Netplex Json-Smart-V1

Netplex Json-Smart-V2

References · 27

• 🔥 https://github.com/netplex/json-smart-v2/issues/60 · Exploit
• 🔥 https://github.com/netplex/json-smart-v1/issues/7 · Exploit
• https://bdu.fstec.ru/vul/2022-01228 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/GHSA-v528-7hrm-frqp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27568 · Security Note
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://github.com/netplex/json-smart-v2 · Note
• https://github.com/netplex/json-smart-v2/pull/72 · Note
• https://github.com/netplex/json-smart-v2/issues/62 · Note
• https://github.com/netplex/json-smart-v1/commit/768db58ee0e3e344fcdb574b7629765308a1d0af · Note
• https://t.me/cvenotify/44375 · Telegram Post
• https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa@%3Ccommits.druid.apache.org%3E · Note