jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser.
This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
Attack Parameters
Attack Vector
Network
Атака возможна удалённо
Attack Complexity
Low
Легко эксплуатировать
Attack Requirements
None
Нет дополнительных условий
Privileges Required
None
Права не нужны
User Interaction
None
Не нужно действие пользователя
Impact Assessment
Confidentiality
None
Нет утечки данных
Integrity
None
Нет модификации данных
Availability
High
Полный отказ в обслуживании
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaa…
security-advisories@github.com
https://github.com/FasterXML/jackson-core/pull/1554
security-advisories@github.com
https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w5…
security-advisories@github.com