Skip to content
OpenAdvisories
Medium USN-6179-1 1 CVE

libjettison-java vulnerability

Published Jun 20, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Jettison incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libjettison-java 1.2-3ubuntu0.1~esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libjettison-java 1.4.0-1ubuntu0.18.04.1~esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libjettison-java 1.4.0-1ubuntu0.20.04.1+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS libjettison-java 1.4.1-1ubuntu0.22.04.1+esm1

Vulnerabilities 1

  • Medium 5.9
    CVE-2023-1436

    Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

    An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

    Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2023-1436