OSV-2023-335 Security exception in org.json.JSONArray.writeTo
A security exception in the org.json library's JSONArray.writeTo method can cause a denial of service when processing malformed JSON data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is OSV-2023-335?
OSV-2023-335 is a denial of service vulnerability in spring-boot, published on 22 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58204
Crash type: Security exception
Crash state:
org.json.JSONArray.writeTo
org.json.JSONStringer.value
org.json.JSONStringer.peek
Which versions are affected by OSV-2023-335?
1 open source package ship an affected version, including spring-boot.
| Package | Affected | Fixed in |
|---|---|---|
spring-boot OSS-Fuzz | All versions | None |
How do I fix OSV-2023-335?
No fix has been published for OSV-2023-335 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is OSV-2023-335 being exploited?
There is no known exploitation of OSV-2023-335 in the wild and no public exploit code.