CVE-2022-21653
Medium
Description
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
SeverityMedium
CVSS5.9
Exploit probability—
ProductTypelevel Jawn
PublishedJan 5, 2022
First seenJan 5, 2022
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- typelevel jawn1.3.2 or later
- org.typelevel:jawn-parser_2.121.3.2 or later
- org.typelevel:jawn-parser_2.131.3.2 or later
- org.typelevel:jawn-parser_31.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typelevel jawn | v < 1.3.2 | 1.3.2 |
| org.typelevel:jawn-parser_0.25Maven | No range specified | — |
| org.typelevel:jawn-parsergMaven | No range specified | — |
| org.typelevel:jawn-parser_0.27Maven | No range specified | — |
| org.typelevel:jawn-parser_2.10Maven | No range specified | — |
| org.typelevel:jawn-parser_2.11Maven | No range specified | — |
| org.typelevel:jawn-parser_2.12Maven | v < 1.3.2 | 1.3.2 |
| org.typelevel:jawn-parser_2.13Maven | v < 1.3.2 | 1.3.2 |
| org.typelevel:jawn-parser_2.13.0-M5Maven | No range specified | — |
| org.typelevel:jawn-parser_2.13.0-RC1Maven | No range specified | — |
| org.typelevel:jawn-parser_2.13.0-RC2Maven | No range specified | — |
| org.typelevel:jawn-parser_2.13.0-RC3Maven | No range specified | — |
| org.typelevel:jawn-parser_3Maven | v < 1.3.2 | 1.3.2 |
| org.typelevel:jawn-parser_3.0.0-M1Maven | No range specified | — |
| org.typelevel:jawn-parser_3.0.0-M2Maven | No range specified | — |
| org.typelevel:jawn-parser_3.0.0-M3Maven | No range specified | — |
| org.typelevel:jawn-parser_3.0.0-RC1Maven | No range specified | — |
| org.typelevel:jawn-parser_3.0.0-RC2Maven | No range specified | — |
| org.typelevel:jawn-parser_3.0.0-RC3Maven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.