PT-2025-17447 · Amazon · Amazon.Iondotnet

Josh Coleman · Published 2025-04-21 · Updated 2025-04-26 · CVE-2025-3857

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon.IonDotnet versions prior to 1.3.1

Description The issue occurs when reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class. Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service.

Recommendations Upgrade to Amazon.IonDotnet version 1.3.1 and ensure any forked or derivative code is patched to incorporate the new fixes.

Fix

DoS

Infinite Loop

Deserialization of Untrusted Data

Weakness Enumeration

CWE-835

CWE-502

Related Identifiers

CVE-2025-3857

GHSA-GM2P-WF5C-W3PJ

Affected Products

Amazon.Iondotnet

References · 21

• https://github.com/amazon-ion/ion-dotnet/releases/tag/v1.3.1 · Patch
• https://osv.dev/vulnerability/GHSA-gm2p-wf5c-w3pj · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2025-009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3857 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3857 · Vendor Advisory
• https://github.com/amazon-ion/ion-dotnet · Note
• https://github.com/amazon-ion/ion-dotnet/security/advisories/GHSA-gm2p-wf5c-w3pj · Note
• https://github.com/amazon-ion/ion-dotnet/commit/34a4f5215eceac1bb7bf434c4f2310d64d1b703b · Note
• https://twitter.com/CveFindCom/status/1914583462939414926 · Twitter Post
• https://twitter.com/vulert_official/status/1914650365976265127 · Twitter Post
• https://twitter.com/cracbot/status/1915722506767372435 · Twitter Post
• https://twitter.com/cybercronai/status/1914793980379734314 · Twitter Post
• https://twitter.com/CVEnew/status/1914341974808711526 · Twitter Post
• https://twitter.com/cyberbessa/status/1914711306348744971 · Twitter Post
• https://twitter.com/cybercronai/status/1914663101846237368 · Twitter Post