CVE-2022-21653 Hash collision in typelevel jawn
Attackers can cause denial of service in applications using Jawn JSON parser via hash collision attacks if specific traits are not overridden.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21653?
CVE-2022-21653 is a medium-severity denial of service vulnerability in typelevel jawn, published on 5 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
Which versions are affected by CVE-2022-21653?
36 open source packages ship an affected version, including org.typelevel:jawn-parser_0.25, org.typelevel:jawn-parser_0.27 and org.typelevel:jawn-parser_2.10. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.typelevel:jawn-parser_0.25 Maven | All versions | None |
org.typelevel:jawn-parser_0.25 Maven | All versions | None |
org.typelevel:jawn-parser_0.27 Maven | All versions | None |
org.typelevel:jawn-parser_0.27 Maven | All versions | None |
org.typelevel:jawn-parser_2.10 Maven | All versions | None |
org.typelevel:jawn-parser_2.10 Maven | All versions | None |
30 more packages
org.typelevel:jawn-parser_2.11 Maven | All versions | None |
org.typelevel:jawn-parser_2.11 Maven | All versions | None |
org.typelevel:jawn-parser_2.12 Maven | All versions | 1.3.2 |
org.typelevel:jawn-parser_2.12 Maven | All versions | 1.3.2 |
org.typelevel:jawn-parser_2.13 Maven | All versions | 1.3.2 |
org.typelevel:jawn-parser_2.13 Maven | All versions | 1.3.2 |
org.typelevel:jawn-parser_2.13.0-M5 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-M5 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-RC1 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-RC1 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-RC2 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-RC2 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-RC3 Maven | All versions | None |
org.typelevel:jawn-parser_2.13.0-RC3 Maven | All versions | None |
org.typelevel:jawn-parser_3 Maven | All versions | 1.3.2 |
org.typelevel:jawn-parser_3 Maven | All versions | 1.3.2 |
org.typelevel:jawn-parser_3.0.0-M1 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-M1 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-M2 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-M2 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-M3 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-M3 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-RC1 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-RC1 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-RC2 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-RC2 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-RC3 Maven | All versions | None |
org.typelevel:jawn-parser_3.0.0-RC3 Maven | All versions | None |
org.typelevel:jawn-parserg Maven | All versions | None |
org.typelevel:jawn-parserg Maven | All versions | None |
Linux distribution packages (4)
jawn SUSE:Package Hub 15 SP2 | All versions | 0.14.1-bp152.2.3.1 |
jawn SUSE:Package Hub 15 SP3 | All versions | 0.14.1-bp153.2.3.1 |
jawn openSUSE:Leap 15.3 | All versions | 0.14.1-3.3.1 |
jawn openSUSE:Leap 15.3 | All versions | 0.14.1-bp153.2.3.1 |
Products include Typelevel Jawn.
How do I fix CVE-2022-21653?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-21653 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21653 exists.
Sources
Also known as GHSA-vc89-hccf-rq55, UBUNTU-CVE-2022-21653, openSUSE-SU-2022:0011-1, openSUSE-SU-2022:0045-1, openSUSE-SU-2022:0106-1, openSUSE-SU-2024:11718-1.