PT-2023-4904 · Unknown+4 · Json Smart+5
Ori Hollander
·
Published
2023-03-13
·
Updated
2026-05-18
·
CVE-2023-1370
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Json-smart versions 2.5.0 through 2.5.1
Description
The issue is related to uncontrolled recursion in the Json-smart library. When the library encounters a '{' or '[' character in the JSON input, it parses an object or array respectively. However, there is no limit to the nesting of these objects or arrays, which can cause a stack exhaustion and crash the software. This can be exploited by an attacker to cause a Denial of Service (DoS).
Recommendations
For Json-smart versions 2.5.0 through 2.5.1, upgrade to a version that includes a fix for this issue. As a temporary workaround, consider restricting the use of the Json-smart library to minimize the risk of exploitation. Avoid using the library to parse JSON input with deeply nested objects or arrays until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Jira
Jira Service Management Server
Json Smart
Linuxmint
Ubuntu