Vulnerability · Published Aug 19, 2022 · Assigned by GitHub_M

CVE-2022-23460Stack overflow in Jsonxx

Medium 5.9

In plain English

A medium-severity stack buffer overflow in Jsonxx from hjiang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.7%top 45.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized (ASAN) build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the current commit of the jsonxx project and the project itself has been archived. Updates are not expected. Users are advised to find a replacement.

Affected products (as reported)

Vendor	Product	Versions
hjiang	Jsonxx	unspecified – through 1.0.1

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://securitylab.github.com/advisories/GHSL-2022-049_Jsonxx x_refsource_MISC