Vulnerability · Published Jan 3, 2024 · Assigned by VulnCheck
CVE-2024-21907Improper Handling of Exceptional Conditions in Newtonsoft.Json
High 7.5
In plain English
A high-severity security flaw in Newtonsoft.Json. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 32.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | newtonsoft.json | 13.0.1 | GHSA-5crp-9r3c-p9vr |
| Ubuntu:22.04:LTS | newtonsoft-json | no fix listed | UBUNTU-CVE-2024-21907 |
| Ubuntu:24.04:LTS | newtonsoft-json | no fix listed | UBUNTU-CVE-2024-21907 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Newtonsoft.Json | 0 – before 13.0.1 |
Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457 issue-tracking
- https://github.com/JamesNK/Newtonsoft.Json/pull/2462 issue-tracking
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66 patch
- https://alephsecurity.com/2018/10/22/StackOverflowException/ related
- https://alephsecurity.com/vulns/aleph-2018004 related
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678 related
- https://github.com/advisories/GHSA-5crp-9r3c-p9vr vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr third-party-advisory