CVE-2023-1436: Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray
A flaw was found in Jettison. Infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This issue leads to a StackOverflowError exception being thrown.
Other sources
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.11.1686831822-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.13.1686680473-1.el8 - Upgrade
Upgrade
redhat/eap7-jettisonto a version that resolves this vulnerability.Fixed in 0:1.5.4-1.redhat_00002.1.el8ea - Upgrade
Upgrade
redhat/eap7-jettisonto a version that resolves this vulnerability.Fixed in 0:1.5.4-1.redhat_00002.1.el9ea - Upgrade
Upgrade
redhat/eap7-jettisonto a version that resolves this vulnerability.Fixed in 0:1.5.4-1.redhat_00002.1.el7ea - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.9-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.9-1.redhat_00001.1.el8 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.9-1.redhat_00001.1.el9
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-1436.
What is the severity of CVE-2023-1436?
CVE-2023-1436 has a severity level of high.
Which software products are affected by CVE-2023-1436?
CVE-2023-1436 affects IBM Sterling External Authentication Server version 6.0.3 and 6.1.0, Jenkins version 2-plugins-0:4.11.1686831822-1.el8 and 2-plugins-0:4.13.1686680473-1.el8, and EAP7 Jettison version 0:1.5.4-1.redhat_00002.1.el8ea, 0:1.5.4-1.redhat_00002.1.el9ea, and 0:1.5.4-1.redhat_00002.1.el7ea.
How can an attacker exploit CVE-2023-1436?
An attacker can exploit CVE-2023-1436 by sending a specially crafted request to the vulnerable software, triggering an infinite recursion and causing a denial of service.
Is there a patch available for CVE-2023-1436?
Yes, there is a patch available for CVE-2023-1436. For IBM Sterling External Authentication Server, you can find the patch at http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther+software&product=ibm/Other+software/Sterling+External+Authentication+Server&release=6.0.2.0&platform=All&function=all. For Jenkins, you can find the patch at http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther+software&product=ibm/Other+software/Sterling+External+Authentication+Server&release=6.0.2.0&platform=All&function=all.