Denial Of Service (DoS)

johnzon-mapper is vulnerable to Denial Of Service DoS. The vulnerability exists because it does not validate JSON user input for large numbers, which allows an attacker to inject a large number which will then be parsed by BigDecimal, resulting in Denial of Service...

Apache Johnzon Deserialization of Untrusted Data vulnerability

A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion Denial of service risk. Apache Johnzon 1.2.21 mitigates this by setting a...

CVE-2023-33008

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

CVE-2023-33008

CVE-2023-33008 describes a deserialization flaw in Apache Johnzon that can cause a slow-deserialization/Denial-of-Service when processing untrusted JSON numbers like 1e20000000, due to converting to BigDecimal. Affected Johnzon versions prior to 1.2.21 are vulnerable; Johnzon 1.2.21 mitigates thi...

CVE-2023-33008 Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

CVE-2023-33008 Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

CVE-2023-33008 Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

PT-2023-4628 · Apache · Apache Johnzon

Name of the Vulnerable Software and Affected Versions: Apache Johnzon versions 1.2.0 through 1.2.20 Description: A malicious attacker can craft JSON input that uses large numbers, such as 1e20000000, which Apache Johnzon will deserialize into BigDecimal. This may result in a slow conversion, posi...

SUSE CVE-2009-1904

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service application crash via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type...

SUSE CVE-2011-0188

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service applicati...

Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2019-0774)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Arbitrary Code Execution

ruby is vulnerable to arbitrary code execution. A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker could use this flaw to cause memory corruption, causing a Ruby application that uses the BigDecimal...

Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2019-1585)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2019:14059-1 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: Update to Java 7.1 Service Refresh 4 Fix Pack 45. Security issues fixed: - CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. - CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729. -...

EulerOS 2.0 SP5 : java-1.7.0-openjdk (EulerOS-SA-2019-1759)

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenJDK: Slow conversion of BigDecimal to long CVE-2019-2602 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction...

EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2019-1745)

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenJDK: Improper field access checks CVE-2018-3169 - OpenJDK: Font layout engine out of bounds access setCurrGlyphID CVE-2019-2698 ...

SUSE-SU-2019:1308-2 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 5 Fix Pack 35. Security issues fixed: - CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. - CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729. -...

SUSE-SU-2019:1392-1 Security update for java-1_7_0-openjdk

This update for java-170-openjdk fixes the following issues: Update to 2.6.18 - OpenJDK 7u221 April 2019 CPU Security issues fixed: - CVE-2019-2602: Fixed flaw inside BigDecimal implementation Component: Libraries bsc1132728. - CVE-2019-2684: Fixed flaw inside the RMI registry implementation...

EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2019-1585)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenJDK: Font layout engine out of bounds access setCurrGlyphID CVE-2019-2698 - OpenJDK: Slow conversion of BigDecimal to long...