CVE-2023-7272: Eclipse Parsson stack overflow with deeply nested objects
First published: Wed Jul 17 2024(Updated: )
In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.
Credit: emo@eclipse.org emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.eclipse.parsson:parsson | <1.0.4 | 1.0.4 |
| maven/org.eclipse.parsson:parsson | >=1.1.0<1.1.3 | 1.1.3 |
| Eclipse Parsson | <1.0.4 | |
| Eclipse Parsson | >=1.1.0<1.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/12
- https://nvd.nist.gov/vuln/detail/CVE-2023-7272
- https://github.com/eclipse-ee4j/parsson/issues/91
- https://github.com/eclipse-ee4j/parsson/commit/755d2a86dff74fecc4114fbe7d21e071380c4e45
- https://github.com/eclipse-ee4j/parsson/commit/d0ec79badd44a940c82842954430762a2199f4e1
- https://github.com/advisories/GHSA-2rwm-xv5j-777p (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-7272?
CVE-2023-7272 has a severity rating that indicates it can lead to a denial of service when processing deeply nested JSON documents.
How do I fix CVE-2023-7272?
To fix CVE-2023-7272, update Eclipse Parsson to version 1.0.4 or 1.1.3 or later.
What software is affected by CVE-2023-7272?
CVE-2023-7272 affects Eclipse Parsson versions prior to 1.0.4 and between 1.1.0 and 1.1.2.
What kind of attack does CVE-2023-7272 allow?
CVE-2023-7272 allows attackers to exploit nested object parsing leading to a stack overflow exception.
What is the impact of CVE-2023-7272?
The impact of CVE-2023-7272 is primarily denial of service due to Java stack overflow exceptions.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/references
- agent/author
- collector/nvd-cve
- source/NVD
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2rwm-xv5j-777p
- alias/CVE-2023-7272
- agent/software-canonical-lookup
- collector/github-advisory
- agent/trending
- agent/source
- collector/nvd-api
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/event
- package-manager/maven
- vendor/eclipse
- canonical/eclipse parsson
- version/eclipse parsson/1.1.0