Log in Start free

Vulnerability · Published Oct 12, 2023 · Assigned by Google

CVE-2023-5072DoS Vulnerability in JSON-Java

High 7.5

In plain English

A high-severity resource allocation without limits in the openjdk17 package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 22.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openjdk1717.0.10_p7-r0ALPINE-CVE-2023-5072
Alpine:v3.21openjdk1717.0.10_p7-r0ALPINE-CVE-2023-5072
Alpine:v3.22openjdk1717.0.10_p7-r0ALPINE-CVE-2023-5072
Alpine:v3.23openjdk1717.0.10_p7-r0ALPINE-CVE-2023-5072
Alpine:v3.24openjdk1717.0.10_p7-r0ALPINE-CVE-2023-5072
Alpine:v3.20openjdk2121.0.2_p13-r0ALPINE-CVE-2023-5072
Alpine:v3.21openjdk2121.0.2_p13-r0ALPINE-CVE-2023-5072
Alpine:v3.22openjdk2121.0.2_p13-r0ALPINE-CVE-2023-5072
Alpine:v3.23openjdk2121.0.2_p13-r0ALPINE-CVE-2023-5072
Alpine:v3.24openjdk2121.0.2_p13-r0ALPINE-CVE-2023-5072
Debian:12jenkins-jsonno fix listedDEBIAN-CVE-2023-5072
Debian:13jenkins-jsonno fix listedDEBIAN-CVE-2023-5072
Debian:14jenkins-jsonno fix listedDEBIAN-CVE-2023-5072
Debian:12libjettison-javano fix listedDEBIAN-CVE-2023-5072
Debian:13libjettison-javano fix listedDEBIAN-CVE-2023-5072
Debian:14libjettison-javano fix listedDEBIAN-CVE-2023-5072
Debian:12libjson-javano fix listedDEBIAN-CVE-2023-5072
Debian:13libjson-java3.1.0+dfsg-1DEBIAN-CVE-2023-5072
Debian:14libjson-java3.1.0+dfsg-1DEBIAN-CVE-2023-5072
Mavenorg.json:json20231013GHSA-4jq9-2xhw-jpx7
Ubuntu:22.04:LTSjenkins-jsonno fix listedUBUNTU-CVE-2023-5072
Ubuntu:24.04:LTSjenkins-jsonno fix listedUBUNTU-CVE-2023-5072
Ubuntu:25.10jenkins-jsonno fix listedUBUNTU-CVE-2023-5072
Ubuntu:26.04:LTSjenkins-jsonno fix listedUBUNTU-CVE-2023-5072
Ubuntu:26.10jenkins-jsonno fix listedUBUNTU-CVE-2023-5072
Ubuntu:24.04:LTSlibjettison-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:25.10libjettison-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:26.04:LTSlibjettison-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:26.10libjettison-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:22.04:LTSlibjson-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:24.04:LTSlibjson-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:25.10libjson-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:26.04:LTSlibjson-javano fix listedUBUNTU-CVE-2023-5072
Ubuntu:26.10libjson-javano fix listedUBUNTU-CVE-2023-5072

Affected products (as reported)

VendorProductVersions
https://github.com/stleary/JSON-java n/a 0 – through 20230618

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References