Severity
7.5
High severity
Details
- CVSS score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
Impact
Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:
- Reads deeply nested (1000s of levels) JSON as
JsonNode(ObjectMapper.readTree()) - Writes out same (or modifided) node using
JsonNode.toString()
which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).
Patches
Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.
Workarounds
Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)
Details
- Affected product:
- Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Solr , Apache Spark , Apache Struts , Hibernate , Jackson , Spring , Wildfly , accumulo , activemq , agepredictor , archaius , avro , aws-java-sdk-xray , aws-sdk-java , aws-xray-sdk-java , azure-sdk-for-java , calcite , camel , cassandra-java-driver , consul-client , corda , couchbase-jvm-clients , docker-java , docx4j , droolsjbpm-integration , elasticsearch , etcd4j , flink , gradle , hazelcast , hbase , http-client , hystrix , incubator-retired-htrace , java-apns , java-cas-client , java-driver , java-jwt , jersey , json-patch , json-schema-validator , kubernetes-client , logging-flume , neo4j-ogm , olingo-odata4 , openstack4j , parquet-java , pulsar , rescu , ribbon , smallrye-open-api , swagger-core , swagger-parser , tika , tinkerpop , trendrrnsqclient , twilio-java , vert.x , web3j , wildfly , xchange , zendesk-java-client
- Affected packages:
- avro-archetypes-parent @ 1.10.2 (+4980 more)