OPENSUSE-SU-2024:11718-1 jawn-ast-0.14.1-2.1 on GA media

These are all security issues fixed in the jawn-ast-0.14.1-2.1 package on the GA media of openSUSE Tumbleweed...

Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

org.typelevel:jawn-ast_0.27 (1.0.0), org.typelevel:jawn-util_0.27 (1.0.0) potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.0)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.0 - org.typelevel:jawn-util0.27 1.0.0 Source cves: CVE-2022-21653 Sour...

org.typelevel:jawn-ast_0.27 (1.0.1), org.typelevel:jawn-json4s_0.27 (1.0.1) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.1)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.1 - org.typelevel:jawn-json4s0.27 1.0.1 - org.typelevel:jawn-play0.27...

org.typelevel:jawn-ast_0.27 (1.0.2), org.typelevel:jawn-json4s_0.27 (1.0.2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.2)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.2 - org.typelevel:jawn-json4s0.27 1.0.2 - org.typelevel:jawn-play0.27...

org.typelevel:jawn-ast_0.25 (1.0.0), org.typelevel:jawn-util_0.25 (1.0.0) potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.25 (1.0.0)

org.typelevel:jawn-parser0.25 MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.25 and may be impacted: - org.typelevel:jawn-ast0.25 1.0.0 - org.typelevel:jawn-util0.25 1.0.0 Source cves: CVE-2022-21653 Sour...

org.typelevel:jawn-argonaut_2.10 (0.14.0), org.typelevel:jawn-ast_2.10 (0.14.0) +6 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.10 (0.14.0)

org.typelevel:jawn-parser2.10 MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.10 and may be impacted: - org.typelevel:jawn-argonaut2.10 0.14.0 - org.typelevel:jawn-ast2.10 0.14.0 -...

org.typelevel:jawn-ast_2.11 (>=1.0.0-rc1, <=1.0.0-rc2), org.typelevel:jawn-json4s_2.11 (>=1.0.0-rc1, <=1.0.0-rc2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.11 (>=1.0.0-rc1, <=1.0.0-rc2)

org.typelevel:jawn-parser2.11 MAVEN version =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc2 Source cves: CVE-2022-21653 Source advisory: GHSA-VC89-HCCF-RQ55...

org.typelevel:jawn-ast_0.25 (1.0.0), org.typelevel:jawn-util_0.25 (1.0.0) potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.25 (1.0.0)

org.typelevel:jawn-parser0.25 MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.25 and may be impacted: - org.typelevel:jawn-ast0.25 1.0.0 - org.typelevel:jawn-util0.25 1.0.0 Source cves: CVE-2022-21653 Sour...

PT-2022-15008

Name of the Vulnerable Software and Affected Versions jawn-parser versions prior to 1.3.1 org.typelevel :: jawn-ast versions prior to 0.8.0 Description Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override...