CVE-2024-21634
Description
Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.
How to fix
- amazon ion1.10.5 or later
- com.amazon.ion:ion-java1.10.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amazon ion | v < 1.10.5 | 1.10.5 |
| com.amazon.ion:ion-javaMaven | v < 1.10.5 | 1.10.5 |
| software.amazon.ion:ion-javaMaven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.