Vulnerabilities

 3 via 7 paths

Dependencies

 21

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 1
Status
  • 3
  • 0
  • 0

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: tools.jackson.core:jackson-core
  • Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2

Detailed paths

  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2 › tools.jackson.core:jackson-core@3.2.2
    Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.3.
  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-core@3.2.2
    Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.
  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2 › tools.jackson.core:jackson-core@3.2.2
    Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _reportInvalidToken(int, String, String) method of UTF8DataInputJsonParser, which accumulates invalid token characters into a StringBuilder with no check against ErrorReportConfiguration.getMaxErrorTokenLength(), unlike UTF8StreamJsonParser, ReaderBasedJsonParser, and NonBlockingUtf8JsonParserBase, which enforce the 256-character default. An attacker can exhaust the JVM heap by submitting a sufficiently long malformed token, since the whole token is copied into the exception message, where a 20-million-character token produces a 20,000,109-character message against 367 characters on the bounded path. This requires the application to create its parser through JsonFactory.createParser(DataInput), and no configuration constrains the path, since maxDocumentLength does not apply to DataInput sources and maxStringLength does not cover it.

Remediation

Upgrade tools.jackson.core:jackson-core to version 3.1.7, 3.2.3 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: tools.jackson.core:jackson-databind
  • Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2

Detailed paths

  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2
    Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.3.
  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2
    Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the resolveForwardReference() method of CollectionDeserializer.CollectionReferringAccumulator, and in the corresponding map accumulators, which perform a linear search of the pending accumulator for every resolved object ID. An attacker can consume quadratic CPU and exhaust a request-time or worker-capacity budget by submitting JSON whose N unresolved object-ID references resolve in reverse order, costing roughly N*(N+1)/2 comparisons, measured at 2,003,000 for N=2,000. This requires the application to deserialize attacker-influenced JSON into an identity-enabled collection or map under @JsonIdentityInfo, though it needs no deep nesting or unusual JSON syntax.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.7, 3.2.3 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: tools.jackson.core:jackson-databind
  • Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2

Detailed paths

  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2
    Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.3.
  • Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2
    Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _findDeserializer() method of TypeDeserializerBase, which caches every unknown type ID as a distinct key in the _deserializers map even when all of them resolve to the same defaultImpl fallback. An attacker can grow that cache without bound for the lifetime of the process, exhausting memory over time, by submitting a stream of novel type identifiers. This requires the application to use name-based polymorphism through @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), to accept attacker-controlled type identifiers, and to reuse the mapper instance across requests.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.7, 3.2.3 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report