CVE-2023-33008 Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
Attackers can cause denial of service by sending JSON with excessively large numbers, forcing slow BigDecimal conversions in Apache Johnzon.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33008?
CVE-2023-33008 is a medium-severity denial of service vulnerability in Apache Johnzon, published on 7 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.
A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal.
This issue affects Apache Johnzon: through 1.2.20.
Weakness: CWE-502
Which versions are affected by CVE-2023-33008?
2 open source packages ship an affected version, including org.apache.johnzon:johnzon-mapper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.johnzon:johnzon-mapper Maven | All versions | 1.2.21 |
org.apache.johnzon:johnzon-mapper Maven | All versions | 1.2.21 |
Products include Apache Johnzon.
How do I fix CVE-2023-33008?
Upgrade org.apache.johnzon:johnzon-mapper to 1.2.21 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-33008 being exploited?
There is no known exploitation of CVE-2023-33008 in the wild and no public exploit code.
Sources
Also known as GHSA-crqg-jrpj-fc84.