Vulnerability · Published Dec 8, 2022 · Assigned by GitHub_M
CVE-2022-23496A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa
High 7.5
In plain English
A high-severity security flaw in yauaa from nielsbasjes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | nl.basjes.parse.useragent:yauaa | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-beam | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-beam-sql | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-drill | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-elasticsearch | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-elasticsearch-8 | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-flink | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-flink-table | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-hive | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-logparser | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-snowflake | 7.9.0 | GHSA-c4pm-63cg-9j7h |
| Maven | nl.basjes.parse.useragent:yauaa-trino | 7.9.0 | GHSA-c4pm-63cg-9j7h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nielsbasjes | yauaa | >= 7.0.0, < 7.9.0 |
Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H