CVE-2023-42277 hutool Buffer Overflow vulnerability

What is CVE-2023-42277?

CVE-2023-42277 is a critical memory corruption vulnerability in n/a, published on 8 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.

Weakness: CWE-120

Which versions are affected by CVE-2023-42277?

4 open source packages ship an affected version, including cn.hutool:hutool-core and cn.hutool:hutool-json. It affects 1 product.

Products include Hutool Hutool.

How do I fix CVE-2023-42277?

No fix has been published for CVE-2023-42277 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-42277 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42277 exists.

Other vulnerabilities in n/a

• CVE-2023-42276 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability Critical 9.8
• CVE-2023-24163 Dromara hutool vulnerable to SQL Injection Critical 9.8
• CVE-2022-22885 Improper Certificate Validation in Hutool Critical 9.8
• CVE-2023-51075 hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7p8c-crfr-q93p.