OPENSUSE-SU-2024:11718-1 jawn-ast-0.14.1-2.1 on GA media

These are all security issues fixed in the jawn-ast-0.14.1-2.1 package on the GA media of openSUSE Tumbleweed...

org.typelevel:jawn-ast_3.0.0-M1 (>=1.0.1 <=1.0.2), org.typelevel:jawn-json4s_3.0.0-M1 (>=1.0.1 <=1.0.2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3.0.0-M1 (>=1.0.1 <=1.0.2)

org.typelevel:jawn-parser3.0.0-M1 MAVEN version =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.2 Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

com.github.ghostdogpr:caliban-client_3.0.0-RC3 (=0.10.0), com.github.ghostdogpr:caliban-zio-http_3.0.0-RC3 (=0.10.0) +9 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3.0.0-RC3 (=1.1.2)

org.typelevel:jawn-parser3.0.0-RC3 MAVEN version =1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser3.0.0-RC3 and may be impacted: - com.github.ghostdogpr:caliban-client3.0.0-RC3 =0.10.0 -...

org.typelevel:jawn-ast_0.25 (=1.0.0), org.typelevel:jawn-util_0.25 (=1.0.0) potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.25 (=1.0.0)

org.typelevel:jawn-parser0.25 MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.25 and may be impacted: - org.typelevel:jawn-ast0.25 =1.0.0 - org.typelevel:jawn-util0.25 =1.0.0 Source cves: CVE-2022-21653...

org.typelevel:jawn-ast_2.11 (>=1.0.0-RC1 <=1.0.0-RC2), org.typelevel:jawn-json4s_2.11 (>=1.0.0-RC1 <=1.0.0-RC2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.11 (>=1.0.0-RC1 <=1.0.0-RC2)

org.typelevel:jawn-parser2.11 MAVEN version =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC1, =1.0.0-RC2 Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

org.typelevel:jawn-ast_0.27 (>=1.0.0 <=1.0.2), org.typelevel:jawn-json4s_0.27 (>=1.0.1 <=1.0.2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (>=1.0.0 <=1.0.2)

org.typelevel:jawn-parser0.27 MAVEN version =1.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.2 Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...