CVE-2023-1370

Impact

Affected versions of net.minidev:json-smart are vulnerable to Denial of Service (DoS) due to a StackOverflowError when parsing a deeply nested JSON array or object.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the 3PP does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.

Patches

This vulnerability was fixed in json-smart version 2.4.9, but the maintainer recommends upgrading to 2.4.10, due to a remaining bug.

Workarounds

N/A

References

• https://www.cve.org/CVERecord?id=CVE-2023-1370
• https://nvd.nist.gov/vuln/detail/CVE-2023-1370
• https://security.snyk.io/vuln/SNYK-JAVA-NETMINIDEV-3369748

Json-smart is a performance focused, JSON processor lib.

Security Fix(es):

Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.(CVE-2023-1370)

Json-smart is a performance focused, JSON processor lib.

Security Fix(es):

Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.(CVE-2023-1370)

Json-smart is a performance focused, JSON processor lib.

Security Fix(es):

Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.(CVE-2023-1370)

Json-smart is a performance focused, JSON processor lib.

Security Fix(es):

Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.(CVE-2023-1370)

Red Hat Lightwell has released net.minidev:json-smart 2.4.8.rhlw-00001 with a backported security fix.

CVE-2023-1370: Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

This patched artifact is a drop-in replacement for net.minidev:json-smart 2.4.8 from Maven Central.

Root has patched CVE-2023-1370 in the net.minidev:json-smart package for Root:Maven. Multiple fixed versions available.

Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 1.3.2-tuxcare.1.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 2.4.7-tuxcare.1.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 2.3.1-tuxcare.1.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 2.4.2-tuxcare.2.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 1.1.1-tuxcare.1.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 2.2.1-tuxcare.1.

TuxCare rebuilt net.minidev:json-smart to address 1 CVE. Fixed in 2.3-tuxcare.2.

It was discovered that Json-smart incorrectly handled memory when processing input containing unclosed quotes. A remote attacker could possibly use this issue to cause applications using Json-smart to crash, leading to a denial of service. (CVE-2021-31684)

It was discovered that Json-smart incorrectly handled memory when processing input containing unclosed brackets. A remote attacker could possibly use this issue to cause applications using Json-smart to crash, leading to a denial of service. (CVE-2023-1370)