Skip to content
OpenAdvisories
High ALAS2-2023-2053 1 CVE

Important: jettison security update (Amazon Linux 2)

Published May 25, 2023 · Updated Jun 1, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 jettison 0:1.3.3-4.amzn2.0.2
Amazon Linux · 2 jettison-javadoc 0:1.3.3-4.amzn2.0.2

Vulnerabilities 1

  • Medium 5.9
    CVE-2023-1436

    Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

    An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

    Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-1436.html