Vulnerabilites related to Eclipse Foundation - Parsson
cve-2023-4043
Vulnerability from cvelistv5
Published
2023-11-03 08:11
Modified
2024-09-05 14:31
Severity ?
EPSS score ?
Summary
In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.
To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Eclipse Foundation | Parsson |
Version: 0 ≤ Version: 1.1.0 ≤ |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T07:17:11.483Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://github.com/eclipse-ee4j/parsson/pull/100", }, { tags: [ "x_transferred", ], url: "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-4043", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-09-05T14:21:34.711216Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-09-05T14:31:17.127Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Parsson", vendor: "Eclipse Foundation", versions: [ { lessThan: "1.0.5", status: "affected", version: "0", versionType: "semver", }, { lessThan: "1.1.4", status: "affected", version: "1.1.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Yuan Tian", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p>In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.</p>\n<p>To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.</p><br>", }, ], value: "In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, { descriptions: [ { cweId: "CWE-834", description: "CWE-834 Excessive Iteration", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-11-03T08:11:39.563Z", orgId: "e51fbebd-6053-4e49-959f-1b94eeb69a2c", shortName: "eclipse", }, references: [ { url: "https://github.com/eclipse-ee4j/parsson/pull/100", }, { url: "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13", }, ], source: { discovery: "UNKNOWN", }, title: "Parsson DoS when parsing numbers from untrusted sources", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "e51fbebd-6053-4e49-959f-1b94eeb69a2c", assignerShortName: "eclipse", cveId: "CVE-2023-4043", datePublished: "2023-11-03T08:11:39.563Z", dateReserved: "2023-08-01T14:21:55.370Z", dateUpdated: "2024-09-05T14:31:17.127Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-7272
Vulnerability from cvelistv5
Published
2024-07-17 15:00
Modified
2024-08-02 08:57
Severity ?
EPSS score ?
Summary
In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Eclipse Foundation | Parsson |
Version: 0 ≤ 1.0.3 Version: 1.1.0 ≤ 1.1.2 |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:eclipse_foundation:parsson:*:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "parsson", vendor: "eclipse_foundation", versions: [ { lessThanOrEqual: "1.0.3", status: "affected", version: "0", versionType: "semver", }, { lessThanOrEqual: "1.1.2", status: "affected", version: "1.1.0", versionType: "semver", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-7272", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-07-18T13:26:07.187816Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-07-18T13:31:25.196Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T08:57:35.165Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/12", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Parsson", vendor: "Eclipse Foundation", versions: [ { lessThanOrEqual: "1.0.3", status: "affected", version: "0", versionType: "semver", }, { lessThanOrEqual: "1.1.2", status: "affected", version: "1.1.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "PJ Fanning", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.<br>", }, ], value: "In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.6, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "CWE-787 Out-of-bounds Write", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-17T15:00:20.172Z", orgId: "e51fbebd-6053-4e49-959f-1b94eeb69a2c", shortName: "eclipse", }, references: [ { url: "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/12", }, ], source: { discovery: "UNKNOWN", }, title: "Eclipse Parsson stack overflow with deeply nested objects", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "e51fbebd-6053-4e49-959f-1b94eeb69a2c", assignerShortName: "eclipse", cveId: "CVE-2023-7272", datePublished: "2024-07-17T15:00:20.172Z", dateReserved: "2024-07-17T14:50:06.906Z", dateUpdated: "2024-08-02T08:57:35.165Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }