CVE-2023-1436

NameCVE-2023-1436
DescriptionAn infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1033846

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libjettison-java (PTS)jessie1.2-3vulnerable
stretch (lts), stretch1.5.3-1~deb9u1vulnerable
buster (security), buster, buster (lts)1.5.3-1~deb10u1vulnerable
bullseye (security), bullseye1.5.3-1~deb11u1vulnerable
bookworm1.5.3-1vulnerable
sid, trixie1.5.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libjettison-javasourcejessie(unfixed)end-of-life
libjettison-javasource(unstable)1.5.4-11033846

Notes

[bookworm] - libjettison-java <no-dsa> (Minor issue)
[bullseye] - libjettison-java <no-dsa> (Minor issue)
[buster] - libjettison-java <postponed> (Minor issue, DoS)
https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/
https://github.com/jettison-json/jettison/issues/60
https://github.com/jettison-json/jettison/pull/62
https://github.com/jettison-json/jettison/commit/c20a8be23f698d7d89b7ccf8d328971cf4709b9f (jettison-1.5.4)
Introduced by: https://github.com/jettison-json/jettison/commit/be193159085b9fc2bc3526f8655871f9b0472d06 (jettison-1.3.1)
[stretch] - libjettison-java <postponed> (Minor issue, DoS)

Search for package or bug name: Reporting problems