CVE-2024-47855 JSON-lib mishandles an unbalanced comment string
An attacker can cause a denial of service in applications using JSON-lib by providing an unbalanced comment string in JSON input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47855?
CVE-2024-47855 is a medium-severity denial of service vulnerability in n/a, published on 4 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
Which versions are affected by CVE-2024-47855?
4 open source packages ship an affected version, including net.sf.json-lib:json-lib and org.kordamp.json:json-lib-core.
| Package | Affected | Fixed in |
|---|---|---|
net.sf.json-lib:json-lib Maven | All versions to 2.4 | None |
net.sf.json-lib:json-lib Maven | All versions to 2.4 | None |
org.kordamp.json:json-lib-core Maven | All versions | 3.1.0 |
org.kordamp.json:json-lib-core Maven | All versions | 3.1.0 |
Linux distribution packages (2)
json-lib openSUSE:Leap 15.5 | All versions | 2.4-150200.3.7.1 |
json-lib openSUSE:Leap 15.6 | All versions | 2.4-150200.3.7.1 |
How do I fix CVE-2024-47855?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-47855 being exploited?
There is no known exploitation of CVE-2024-47855 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-47855, GHSA-wwcp-26wc-3fxm, OESA-2024-2228, SUSE-SU-2024:3543-1, UBUNTU-CVE-2024-47855.