The vulnerability of the BigDecimal component in the Apache Johnzon JSON file processing software allows a attacker to cause a service failure.

🗓️ 31 Aug 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

BigDecimal component in Apache Johnzon JSON processing has deserialization flaws enabling remote service failure.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: Denial of service vulnerability in Johnzon affects IBM Business Automation Workflow - CVE-2023-33008	4 Apr 202413:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Master Data Management vulnerable to denial of service from IBM Business Automation Workflow using Apache Johnzon	2 Oct 202422:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	29 Aug 202314:36	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of Service vulnerability affect IBM Business Automation Workflow - CVE-2023-33008	3 Aug 202413:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2024.	2 Feb 202408:25	–	ibm
IBM Security Bulletins	Security Bulletin: The Transformation Advisor Tool in IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Johnzon (CVE-2023-33008)	4 Sep 202316:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard to a denial of service caused by an unsafe deserialization flaw	7 Feb 202417:07	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of Service vulnerability in Apache Johnzon may affect IBM Business Automation Workflow emitters - CVE-2023-33008	2 Feb 202411:19	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Johnzon may affect IBM Robotic Process Automation and result in a denial of service (CVE-2023-33008)	20 Sep 202314:08	–	ibm
Circl	CVE-2023-33008	7 Jul 202314:31	–	circl

Vulners

Node

red_hat jboss_a-mqMatch7

OR

apache johnzonRange≤1.2.20

Source	Link
lists	www.lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l
access	www.access.redhat.com/security/cve/cve-2023-33008
issues	www.issues.apache.org/jira/browse/JOHNZON-397
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
web	www.web.nvd.nist.gov/view/vuln/detail

31 Aug 2023 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 25

CVSS 35.3

EPSS0.01098

BigDecimal vulnerability Apache Johnzon JavaScript Object Notation Deserialization flaws Remote exploitation Service disruption