io.circe:circe-jawn_3.0.0-M3 (>=0.14.0-M2 <=0.14.0-M3), io.circe:circe-parser_3.0.0-M3 (>=0.14.0-M2 <=0.14.0-M3) +10 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3.0.0-M3 (>=1.0.3 <=1.1.0)

org.typelevel:jawn-parser3.0.0-M3 MAVEN version =1.0.3, =0.14.0-M2, =0.14.0-M2, =1.0.1, =1.0.3, =2.0.0, =1.0.3, =1.1.0 - tech.bilal:akka-http-client-circe3.0.0-M3 =0.0.3-beta - tech.bilal:akka-http-jwt-auth3.0.0-M3 =0.0.3-beta - tech.bilal:akka-http-oidc-client3.0.0-M3 =0.0.3-beta Source cves:...

com.softwaremill.sttp.client3:circe_3.0.0-RC1 (>=3.1.5 <=3.2.3), io.circe:circe-jawn_3.0.0-RC1 (=0.14.0-M4) +14 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3.0.0-RC1 (>=1.1.0 <=1.1.1)

org.typelevel:jawn-parser3.0.0-RC1 MAVEN version =1.1.0, =3.1.5, =0.22.0-M4, =0.22.0-M4, =0.22.0-M4, =1.1.0, =1.1.0, =2.0.0, =1.1.0, =1.1.1 - tech.bilal:akka-http-client-circe3.0.0-RC1 =0.0.4-beta - tech.bilal:akka-http-jwt-auth3.0.0-RC1 =0.0.4-beta and more Source cves: CVE-2022-21653 Source...

ai.eto:rikai_2.12 (>=0.0.3 <=0.1.7), ai.mantik:bridge-protocol_2.12 (>=0.3.0 <=0.3.1-rc2) +1286 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.12 (>=0.14.0 <=1.3.1)

org.typelevel:jawn-parser2.12 MAVEN version =0.14.0, =0.0.3, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1-rc2 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

org.typelevel:jawn-argonaut_2.10 (>=0.14.0 <=0.14.1), org.typelevel:jawn-ast_2.10 (>=0.14.0 <=0.14.1) +6 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.10 (>=0.14.0 <=0.14.1)

org.typelevel:jawn-parser2.10 MAVEN version =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.1 Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

GHSA-VC89-HCCF-RQ55 Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

ch.acmesoftware:arangodb-scala-driver-circe_2.11 (=0.3.0), com.47deg:github4s-cats-effect_2.11 (=0.20.0) +322 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.11 (>=0.14.0 <=0.14.3)

org.typelevel:jawn-parser2.11 MAVEN version =0.14.0, =4.0.1, =4.0.1, =4.0.1, =0.4.0, =0.4.0, =0.4.0, =5.0.0, =4.2.0-RC1, =4.2.0-RC1, =4.4.0-RC2 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

com.softwaremill.sttp.client3:circe_3.0.0-RC2 (>=3.3.0-RC1 <=3.3.0-RC5), io.circe:circe-jawn_3.0.0-RC2 (=0.14.0-M5) +15 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3.0.0-RC2 (>=1.1.1 <=1.1.2)

org.typelevel:jawn-parser3.0.0-RC2 MAVEN version =1.1.1, =3.3.0-RC1, =0.9.2, =0.9.2, =0.10.0, =0.22.0-M7, =0.22.0-M7, =1.1.1, =0.0.26, =1.1.1, =1.1.1, =1.1.2 - tech.bilal:akka-http-client-circe3.0.0-RC2 =0.0.5-beta and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

org.typelevel:jawn-ast_2.11 (>=1.0.0-RC1 <=1.0.0-RC2), org.typelevel:jawn-json4s_2.11 (>=1.0.0-RC1 <=1.0.0-RC2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.11 (>=1.0.0-RC1 <=1.0.0-RC2)

org.typelevel:jawn-parser2.11 MAVEN version =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC2 Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

ai.eto:rikai_2.13 (>=0.0.14 <=0.1.7), ai.mantik:bridge-protocol_2.13 (>=0.4.0 <=0.4.0-rc1) +1334 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.13 (>=0.14.2 <=1.3.1)

org.typelevel:jawn-parser2.13 MAVEN version =0.14.2, =0.0.14, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0-rc1 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

au.id.tmm.fetch:fetch-aws-dynamodb_3 (>=0.7.0 <=0.9.2), au.id.tmm.fetch:fetch-aws-textract_3 (>=0.2.0 <=0.9.2) +331 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3 (>=1.1.2 <=1.3.1)

org.typelevel:jawn-parser3 MAVEN version =1.1.2, =0.7.0, =0.2.0, =0.7.0, =0.2.0, =0.2.0, =0.29.0, =0.0.1, =0.0.1, =0.0-08b8c90, =0.0-08b8c90, =0.0-08b8c90, =0.1-f497734 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

CVE-2022-21653

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

Code injection

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

UBUNTU-CVE-2022-21653

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

CVE-2022-21653

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

CVE-2022-21653 Hash collision in typelevel jawn

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

CVE-2022-21653

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

CVE-2022-21653 Hash collision in typelevel jawn

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

CVE-2022-21653

CVE-2022-21653 affects the jawn JSON parser. Extenders of org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade that do not override objectContext() are vulnerable to a hash-collision DoS. The issue is fixed in jawn-parser-1.3.1; upgrading is advised. If upgrading isn’t possible, o...

CVE-2022-21653 Hash collision in typelevel jawn

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...