{"answers":{"affected":"1 open source package ship an affected version, including aeson. It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-3433 in the wild and no public exploit code.","fix":"Upgrade aeson to 2.0.1.0 or later.","what":"CVE-2022-3433 is a medium-severity denial of service vulnerability in aeson, published on 10 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-3433 and fix it if it is affected.\n\nWhat it is: CVE-2022-3433 is a medium-severity denial of service vulnerability in aeson, published on 10 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-3433 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- aeson (Hackage): affected from 0.4.0.0; fixed in 2.0.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-3433/ (Markdown: https://insights.sbomify.com/CVE-2022-3433/index.md)","id":"CVE-2022-3433","markdown":"https://insights.sbomify.com/CVE-2022-3433/index.md","name":"CVE-2022-3433","record":{"aliases":["DEBIAN-CVE-2022-3433","GHSA-p383-f595-x4qw","HSEC-2023-0001","UBUNTU-CVE-2022-3433"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Haskell JSON library","requires_auth":"low_privilege","summary":"A remote attacker can cause a denial of service in applications using the aeson library by sending specially crafted JSON data that triggers hash collisions.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"aeson","vendor":"haskell"}],"cvss":{"score":6.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-326","name":"Inadequate Encryption Strength"},{"id":"CWE-328","name":"Use of Weak Hash"}],"description":"The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.","ecosystems":["Hackage"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Denial of service in aeson","id":"CVE-2022-3433","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":1,"n_references":1,"next":{"headline":"SourceCodester Web-Based Student Clearance System add-student.php prepare cross site scripting","id":"CVE-2022-3434"},"packages":[{"ecosystem":"Hackage","fixed":["2.0.1.0"],"introduced":["0.4.0.0"],"last_affected":[],"package":"aeson","purl":"pkg:hackage/aeson","source":"HSEC-2023-0001"}],"prev":{"headline":"Security feature bypass in BIOS","id":"CVE-2022-3432"},"products":["aeson"],"published":"2022-10-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"open","licence":"CC0 1.0","name":"Haskell Security Response Team","prefix":"HSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["n/a"]},"summary":"A remote attacker can cause a denial of service in applications using the aeson library by sending specially crafted JSON data that triggers hash collisions.","url":"https://insights.sbomify.com/CVE-2022-3433/"}