Bug 13877

Summary:	[CVE 21] johnzon 0.9.4 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	CONFIRMED ---	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	e.kosachev, s.matveev, y.tumanov
Version:	All	Flags:	y.tumanov: secteam_verified?
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2023-33008,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-10-18 20:27:27 MSK

Please patch CVEs for package johnzon version 0.9.4
  
INFO (CVEs are): johnzon 0.9.4
 cves found
CVE-2023-33008
Desc: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.


A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. 


This issue affects Apache Johnzon: through 1.2.20.


Link: https://nvd.nist.gov/vuln/detail/CVE-2023-33008
Severity: MEDIUM

Comment 1 Vladimir Potapov 2023-10-20 17:05:26 MSK

*** Bug 13745 has been marked as a duplicate of this bug. ***

Comment 2 Vladimir Potapov 2023-10-20 17:05:39 MSK

*** Bug 13545 has been marked as a duplicate of this bug. ***