Description
In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.
To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Parsson | < 1.0.5, 1.1.0 – < 1.1.4 | 1.0.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-apache-sshd | 2.12.0-1.redhat_00001.1.el8eap | RHSA-2024:1193, RHSA-2024:1192 |
| Red Hat JBoss EAP 8 | eap8-eclipse-jgit | 6.6.1.202309021850-1.r_redhat_00001.1.el8eap | RHSA-2024:1193, RHSA-2024:1192 |
| Red Hat JBoss EAP 8 | eap8-log4j | 2.19.0-2.redhat_00001.1.el8eap | RHSA-2024:1193, RHSA-2024:1192 |
| Red Hat JBoss EAP 8 | eap8-lucene-core +6 | 8.11.2-2.redhat_00001.1.el8eap | RHSA-2024:1193, RHSA-2024:1192 |
| Red Hat JBoss EAP 8 | eap8-parsson | 1.1.5-1.redhat_00001.1.el8eap | RHSA-2024:1193, RHSA-2024:1192 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.0.1-3.GA_redhat_00002.1.el8eap | RHSA-2024:1193, RHSA-2024:1192 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.parsson:project | >= 1.1.0, < 1.1.4 | 1.1.4 | GHSA-g8p6-p27c-52fx |
| Maven | org.eclipse.parsson:project | < 1.0.5 | 1.0.5 | GHSA-g8p6-p27c-52fx |
Advisories 9
- RHSA-2024:1193 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:1192 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3221 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-1629 Oracle REST Data Services: Schwachstelle gefährdet Verfügbarkeit BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0870 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2024
- WID-SEC-2024-0893 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024