Vulnerability · Published Jun 1, 2021 · Assigned by mitre
CVE-2021-31684
High 7.5
In plain English
A high-severity security flaw in the json-smart package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.3%top 16.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | json-smart | 2.2-2+deb12u1 | DEBIAN-CVE-2021-31684 |
| Debian:13 | json-smart | 2.5.1-1 | DEBIAN-CVE-2021-31684 |
| Debian:14 | json-smart | 2.5.1-1 | DEBIAN-CVE-2021-31684 |
| Maven | net.minidev:json-smart | 1.3.3 | GHSA-fg2v-w576-w4v3 |
| Maven | net.minidev:json-smart | 2.4.4 | GHSA-fg2v-w576-w4v3 |
| Ubuntu:22.04:LTS | json-smart | 2.2-2ubuntu0.22.04.1 | USN-6011-1 |
| Ubuntu:22.04:LTS | json-smart | 2.2-2ubuntu0.22.04.1 | UBUNTU-CVE-2021-31684 |
Affected products (as reported)
References
- https://github.com/netplex/json-smart-v1/issues/10
- https://github.com/netplex/json-smart-v1/pull/11
- https://github.com/netplex/json-smart-v2/issues/67
- https://github.com/netplex/json-smart-v2/pull/68
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20230331 [SECURITY] [DLA 3373-1] json-smart security update mailing-list
- https://security.netapp.com/advisory/ntap-20240621-0006/