PT-2023-27072 · Unknown · Hjson-Java

Lopezalvaro · Published 2023-09-01 · Updated 2023-09-06 · CVE-2023-39685

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions hjson-java versions up to v3.0.0

Description The issue allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string. This can lead to a StringIndexOutOfBoundsException.

Recommendations For hjson-java versions up to v3.0.0, consider updating to a version later than v3.0.0 to resolve the issue. As a temporary workaround, restrict the input of JSON strings to prevent crafted strings from being processed.

Exploit

Fix

Out of bounds Read

Code Injection

Weakness Enumeration

CWE-125

CWE-94

Related Identifiers

CVE-2023-39685

GHSA-94W5-RF69-2H6C

Affected Products

Hjson-Java

References · 7

• 🔥 https://github.com/hjson/hjson-java/issues/27 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39685 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39685 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94w5-rf69-2h6c · Vendor Advisory
• https://github.com/hjson/hjson-java · Note
• https://github.com/hjson/hjson-java/commit/aff0b607929b4397d93dc0d029a56aeefb242602 · Note
• https://t.me/cibsecurity/69638 · Telegram Post