PT-2023-31622 · Atlassian+2 · Bitbucket Data Center/Server+8

Eamonnmcmanus · Published 2023-10-12 · Updated 2025-12-22 · CVE-2023-5072

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JSON-Java versions up to and including 20230618 Bitbucket Data Center and Server versions 7.17.0, 7.21.15, 8.9.4, 8.13.0, 8.14.0, and 8.15.0 Confluence Data Center and Server version 3.0 Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0

Description A denial of service vulnerability in JSON-Java was discovered. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. The issue is caused by the parser bug that can be used to circumvent a check that is supposed to prevent the key in a JSON object from itself being another JSON object. If a key does end up being a JSON object, then it gets converted into a string, using to escape special characters, including itself. This can lead to an exponential number of `` characters in the escaped string, causing a denial of service.

Recommendations For JSON-Java versions up to and including 20230618, upgrade to a version later than 20230618. For Bitbucket Data Center and Server versions 7.17.0, 7.21.15, 8.9.4, 8.13.0, 8.14.0, and 8.15.0, upgrade to the latest version or one of the specified supported fixed versions. For Confluence Data Center and Server version 3.0, upgrade to the latest version or one of the specified supported fixed versions. For Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0, upgrade to the latest version or one of the specified supported fixed versions. As a temporary workaround, consider disabling the use of JSON-Java until a patch is available.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-770

CWE-358

Related Identifiers

CVE-2023-5072

GHSA-4JQ9-2XHW-JPX7

GHSA-RM7J-F5G5-27VV

Affected Products

Bamboo

Bamboo Data Center/Server

Bitbucket

Bitbucket Data Center/Server

Confluence

Confluence Data Center/Server

Debian

Jira

Red Os

References · 32

• 🔥 https://github.com/stleary/JSON-java/issues/771 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-5072 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-5072 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/704074 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/703866 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/703839 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5072 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/703836 · Security Note
• https://ubuntu.com/security/CVE-2023-5072 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rm7j-f5g5-27vv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5072 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jq9-2xhw-jpx7 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-5072 · Vendor Advisory
• https://github.com/stleary/JSON-java/issues/758 · Note