Vulnerability · Published Nov 3, 2023 · Assigned by eclipse
CVE-2023-4043Parsson DoS when parsing numbers from untrusted sources
Medium 5.9
In plain English
A medium-severity improper input validation in Parsson from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.eclipse.parsson:project | 1.1.4 | GHSA-g8p6-p27c-52fx |
| Maven | org.eclipse.parsson:project | 1.0.5 | GHSA-g8p6-p27c-52fx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Parsson | 0 – before 1.0.51.1.0 – before 1.1.4 |
Weakness: CWE-20, CWE-834 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H