Skip to content
OpenAdvisories
Medium ALAS2-2023-2363 1 CVE

Moderate: jettison security update (Amazon Linux 2)

Published Nov 29, 2023 · Updated Dec 4, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40149: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 jettison 0:1.3.3-4.amzn2.0.4
Amazon Linux · 2 jettison-javadoc 0:1.3.3-4.amzn2.0.4

Vulnerabilities 1

  • Medium 6.5
    CVE-2022-40149

    Stack Buffer Overflow in Jettison

    Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…

    Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-40149.html