PT-2024-32854 · Json Lib+3 · Json-Lib+3

Published 2024-10-03 · Updated 2025-10-28 · CVE-2024-47855

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions JSON-lib versions prior to 3.1.0

Description The issue is related to the handling of an unbalanced comment string in the util/JSONTokener.java file. This flaw can be exploited due to the mishandling of such strings.

Recommendations For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the util/JSONTokener.java file until a patch is available.

Fix

Weakness Enumeration

CWE-1286

Related Identifiers

BDU:2025-13819

CVE-2024-47855

GHSA-WWCP-26WC-3FXM

OESA-2024-2228

OPENSUSE-SU-2024_3543-1

RHSA-2025:2218

RHSA-2025:2219

RHSA-2025:2220

RHSA-2025:2221

RHSA-2025:2222

RHSA-2025:2223

SUSE-SU-2024:3543-1

Affected Products

Debian

Json-Lib

Red Os

Suse

References · 27

• https://bdu.fstec.ru/vul/2025-13819 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-47855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47855 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:3543-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47855 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47855 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47855 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2228 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wwcp-26wc-3fxm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47855 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47855 · Vendor Advisory
• https://github.com/kordamp/json-lib/blob/35a1f2aa22bac260438c0cf2399549311b5a21aa/pom.xml · Note
• https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e · Note
• https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0 · Note
• https://github.com/kordamp/json-lib · Note