ALAS-2023-2086

Amazon Linux 2 Security Advisory: ALAS-2023-2086
Advisory Release Date: 2023-06-07 23:52 Pacific
Advisory Updated Date: 2024-02-01 19:57 Pacific
Severity: Important
Issue Overview:

2024-02-01: CVE-2022-40150 was added to this advisory.

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack. (CVE-2022-40150)

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. (CVE-2022-45685)

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. (CVE-2022-45693)


Affected Packages:

jettison


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update jettison to update your system.

New Packages:
noarch:
    jettison-1.3.3-4.amzn2.0.3.noarch
    jettison-javadoc-1.3.3-4.amzn2.0.3.noarch

src:
    jettison-1.3.3-4.amzn2.0.3.src

Additional References

Red Hat: CVE-2022-40150, CVE-2022-45685, CVE-2022-45693

Mitre: CVE-2022-40150, CVE-2022-45685, CVE-2022-45693