Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-51074 EUVD-2023-3260GHSA-pfh2-hfmq-phg5

json-path Out-of-bounds Write vulnerability

Published Dec 27, 2023 · Updated Aug 2, 2024 · Assigned by mitre

Package: com.jayway.jsonpath:json-path Package: jayway-jsonpath Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jayway-jsonpath No fix yet —
Ubuntu 26.04 LTS jayway-jsonpath No fix yet —
Ubuntu 25.10 jayway-jsonpath No fix yet —
Ubuntu 24.04 LTS jayway-jsonpath No fix yet —
Ubuntu 22.04 LTS jayway-jsonpath No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jayway-jsonpath No fix yet —
Ubuntu 18.04 LTS jayway-jsonpath No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling trino +58 437-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.jayway.jsonpath:json-path >= 2.2.0, < 2.9.0 2.9.0 GHSA-pfh2-hfmq-phg5

Advisories 15

References