CVE-2022-40150

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Uncontrolled Resource Consumption pada jettison project jettison, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

Rincian

Terbit di NVD

16 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-674: Uncontrolled Recursion

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549 issue tracking · permissions required · advisory pihak ketiga
• https://github.com/jettison-json/jettison/issues/45 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5312 advisory pihak ketiga