Improper input validation in json-smart - CVE-2021-31684

Vulnerability identifier: #VU65499

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31684

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within indexOf() function of JSONParserByteArray. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

json-smart
Jira Service Management Server
Jira Service Management Data Center
Confluence Data Center
Bamboo Server
Jira Software Data Center
QRadar User Behavior Analytics
IBM Spectrum Symphony
Bitbucket Data Center
Crowd Server
Confluence Server
Juniper Secure Analytics (JSA)
Fuse
Oracle WebLogic Server
Bitbucket Server
Maximo Application Suite - Visual Inspection Component
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
User Entity Behavior Analytics
PeopleSoft Enterprise PeopleTools
Planning Analytics Local
IBM Cognos Analytics
JD Edwards EnterpriseOne Orchestrator
Jira Software Server
Ubuntu
watsonx.data
libjson-smart-java (Ubuntu package)

Install updates from vendor's website.

json-smart - addressed in versions 1.3.3, 2.4.5
Jira Service Management Server - addressed in versions 4.20.27, 4.20.28, 5.4.12
Jira Service Management Data Center - addressed in versions 4.20.27, 4.20.28, 5.4.12
Crowd Server - addressed in versions 5.0.8, 5.1.6, 5.2.1
Confluence Data Center - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.2, 8.7.1
Confluence Server - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.2
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF04
Fuse - update to 7.11.1
Maximo Application Suite - Visual Inspection Component - update to 8.9.20
Bamboo Server - addressed in versions 9.2.7, 9.3.5
Jira Software Server - update to 9.4.13
Jira Software Data Center - update to 9.4.13
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
watsonx.data - update to 2.0.3
libjson-smart-java (Ubuntu package) - addressed in versions 2.2-2ubuntu0.18.04.1, 2.2-2ubuntu0.20.04.1, 2.2-2ubuntu0.22.04.1, 2.2-2ubuntu0.22.10.1
QRadar User Behavior Analytics - update to 4.1.14
IBM Cloud Pak for Watson AIOps - update to 4.6.0
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
User Entity Behavior Analytics - update to 5.0.2
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
Bitbucket Server - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
Bitbucket Data Center - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2

• https://github.com/netplex/json-smart-v1/issues/10
• https://github.com/netplex/json-smart-v1/pull/11
• https://github.com/netplex/json-smart-v2/issues/67
• https://github.com/netplex/json-smart-v2/pull/68

• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Red Hat Fuse
• Denial of service in json-smart
• Ubuntu update for json-smart
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in IBM Spectrum Symphony
• Jira Service Management Data Center and Server update for json-smart
• Atlassian Bamboo Data Center and Server update for third-party applications
• Atlassian Jira Data Center and Server update for third-party software
• Atlassian Jira Service Management Data Center and Server update for third-party software
• Atlassian Crowd Data Center and Server update for third-party software
• Atlassian Confluence Data Center and Server update for third-party software
• Atlassian Bitbucket Data Center and Server update for third-party software
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Juniper Networks Juniper Secure Analytics update for third-party applications
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• IBM watsonx.data update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component