CVE-2022-3433 Denial of service in aeson
A remote attacker can cause a denial of service in applications using the aeson library by sending specially crafted JSON data that triggers hash collisions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3433?
CVE-2022-3433 is a medium-severity denial of service vulnerability in aeson, published on 10 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
Which versions are affected by CVE-2022-3433?
1 open source package ship an affected version, including aeson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aeson Hackage | From 0.4.0.0 | 2.0.1.0 |
Products include Haskell Aeson.
How do I fix CVE-2022-3433?
Upgrade aeson to 2.0.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-3433 being exploited?
There is no known exploitation of CVE-2022-3433 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-3433, GHSA-p383-f595-x4qw, HSEC-2023-0001, UBUNTU-CVE-2022-3433.