Uncontrolled Recursion in json-smart - CVE-2023-1370

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75044

Uncontrolled Recursion in json-smart - CVE-2023-1370

Published: April 12, 2023 / Updated: May 9, 2025


Vulnerability identifier: #VU75044
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-1370
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion when processing nested arrays and objects. A remote attacker can pass specially crafted JSON data to the application and perform a denial of service (DoS) attack.


Affected software

json-smart
OpenShift Developer Tools and Services
Oracle GoldenGate Studio
Red Hat Camel for Spring Boot
IBM App Connect Enterprise
IBM Workload Scheduler
IBM Observability with Instana
IBM Operations Analytics Predictive Insights
Netcool Operations Insight
Elastic Cloud Enterprise
Oracle StorageTek Tape Analytics (STA)
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Assistant for IBM Cloud Pak for Data
Crucible Server
Jira Service Management Data Center
Jira Service Management Server
IBM Intelligent Operations Center
Dell Secure Connect Gateway
Oracle Financial Services Model Management and Governance
WebSphere Remote Server
IBM Maximo Application Suite
Jira Software Data Center
IBM Security Verify Governance
Oracle Middleware Common Libraries and Tools
Middleware Common Libraries and Tools
Enterprise Manager Base Platform
Oracle Graph Server and Client
Oracle Communications Cloud Native Core Binding Support Function
Red Hat Integration Camel-K
IBM Cloud Pak for Security
IBM Process Mining
IBM Spectrum Conductor
Red Hat Integration Camel Extensions for Quarkus
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Tivoli Business Service Manager
Datastax Enterprise with IBM
IBM Spectrum Symphony
IBM Cloud Application Performance Management (APM)
AMQ Clients
API Gateway
Oracle WebLogic Server
Primavera Gateway
AMQ Streams
Fuse
API Manager
IBM Data Risk Manager
IBM Db2 Web Query for i
Oracle Utilities Application Framework
Elasticsearch
GoldenGate Veridata
Oracle Banking Corporate Lending Process Management
Oracle Banking Trade Finance Process Management
Oracle Banking Cash Management
Oracle Banking Supply Chain Finance
Oracle Banking Liquidity Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Virtual Account Management
Astronomer with IBM
Storage Defender - Resiliency Service
Cloudera Observability with IBM
Knowledge Catalog Premium Cartridge
Dell Policy Manager for Secure Connect Gateway (SCG)
Oracle Business Intelligence Enterprise Edition
Db2 Big SQL
Oracle Financial Services Analytical Applications Infrastructure
Maximo Application Suite - Visual Inspection Component
IBM OpenPages with Watson
IBM Engineering Requirements Management DOORS Next
dashDB Local
Oracle Policy Automation
Oracle Data Integrator
Oracle Application Testing Suite
Oracle FLEXCUBE Universal Banking
Oracle FLEXCUBE Investor Servicing
Oracle Siebel CRM
Business Automation Insights
IBM Watson Machine Learning Accelerator
Cloud Pak for Network Automation
Application Modernization Accelerator
IBM Cloud Pak for Watson AIOps
User Entity Behavior Analytics
Storage Resource Manager
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
Storage Protect Server
webMethods Managed File Transfer
Oracle Solaris Cluster
Ubuntu
openEuler
Red Hat OpenShift Container Platform
Primavera Unifier
OSS Support Tools
IBM Cloud Pak for Multicloud Management
Communications Unified Assurance
Spring Security
Juniper Secure Analytics (JSA)
Jira Software Server
IBM DB2
IBM InfoSphere Information Server
Oracle Commerce Guided Search
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
OpenView Performance Manager (OVPM)
IBM Security Verify Access
Planning Analytics Local
Operational Decision Manager
IBM Cognos Analytics
watsonx.data
json-smart-javadoc
json-smart
libjson-smart-java (Ubuntu package)
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
IBM Cloud Pak System
Dell EMC Storage Monitoring and Reporting (SMR)

How to mitigate CVE-2023-1370

Install updates from vendor's website.

json-smart - update to 2.4.9
API Gateway - update to May 2023
API Manager - update to May 2023
Astronomer with IBM - update to 1.0.1
IBM Observability with Instana - update to 1.0.297
Netcool Operations Insight - update to 1.6.15
Storage Defender - Resiliency Service - update to 2.0.14
Elastic Cloud Enterprise - addressed in versions 2.13.3, 3.3.0
IBM Data Risk Manager - update to 2.0.6.17
Cloudera Observability with IBM - update to 3.6.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Crucible Server - update to 4.9.1
Red Hat OpenShift Container Platform - addressed in versions 4.10.61, 4.11.44
Jira Service Management Data Center - addressed in versions 4.20.27, 10.3.17, 11.3.3
Jira Service Management Server - update to 4.20.27
Knowledge Catalog Premium Cartridge - update to 5.2
Spring Security - update to 5.8.4
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.16.00.14
Dell Secure Connect Gateway - update to 5.16
Elasticsearch - addressed in versions 7.17.11, 8.8.2
Db2 Big SQL - update to 7.6.2
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF04
Maximo Application Suite - Visual Inspection Component - update to 8.9.20
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4, 8.10.6, 8.11.1
Jira Software Data Center - addressed in versions 9.4.18, 9.12.6, 9.12.34, 9.13.0, 10.3.17, 11.3.3
Jira Software Server - addressed in versions 9.4.18, 9.12.6, 9.13.0
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
dashDB Local - update to 11.5.9.0
Oracle Policy Automation - update to 12.2.31
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
OpenView Performance Manager (OVPM) - update to T0684V01^ABL
IBM Watson Machine Learning Accelerator - update to 1.2.3 601632-wmla
Red Hat Integration Camel-K - update to 1.10.1
IBM Cloud Pak for Security - update to 1.11.2.0
IBM Process Mining - update to 1.14.1
AMQ Streams - addressed in versions 2, 2.4.0, 2.7.0
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
watsonx.data - addressed in versions 2.0.1, 2.0.3
json-smart-javadoc - addressed in versions 2.2-2, 2.5.2-1
json-smart - addressed in versions 2.2-2, 2.5.2-1
libjson-smart-java (Ubuntu package) - addressed in versions 2.2-2ubuntu0.18.04.1, 2.2-2ubuntu0.20.04.1, 2.2-2ubuntu0.22.04.1, 2.2-2ubuntu0.22.10.1
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Cloud Pak for Network Automation - update to 2.4.6
IBM Spectrum Conductor - update to 2.5.1 FP2
Red Hat Integration Camel Extensions for Quarkus - addressed in versions 2.7.1-1, 2.13.2-2
jenkins (Red Hat package) - addressed in versions 2.401.1.1686649641-3.el8, 2.401.1.1686680404-3.el8, 2.401.1.1686831596-3.el8, 2.504.2.1750846524-3.el9, 2.504.2.1750851690-3.el9, 2.504.2.1750856366-3.el8, 2.504.2.1750857144-3.el9, 2.504.2.1750903189-3.el8, 2.504.2.1750916374-3.el8, 2.504.2.1750932984-3.el8
IBM Cloud Transformation Advisor - update to 3.5.2
Red Hat Camel for Spring Boot - addressed in versions 3.18.3 Patch 1, 3.18.3 Patch 2, 3.20.1
QRadar User Behavior Analytics - update to 4.1.14
Application Modernization Accelerator - update to 4.2.0
IBM Cloud Pak for Watson AIOps - update to 4.6.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
jenkins-2-plugins (Red Hat package) - addressed in versions 4.11.1686831822-1.el8, 4.12.1686649756-1.el8, 4.12.1750933270-1.el8, 4.13.1686680473-1.el8, 4.13.1750916671-1.el8, 4.14.1750903529-1.el8, 4.15.1750856638-1.el8, 4.16.1750857315-1.el9, 4.17.1750851950-1.el9, 4.18.1750846854-1.el9
User Entity Behavior Analytics - update to 5.0.2
Storage Resource Manager - update to 5.0.2.2
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.2
IBM Tivoli Business Service Manager - update to 6.2.0.5.4
Datastax Enterprise with IBM - addressed in versions 6.8.63, 6.9.20
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix022, 7.1.0 iFix007
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
Fuse - update to 7.12.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.22
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 34, 8.11.0.1 Interim fix 17, 8.11.1 Interim fix 5
IBM Security Verify Access - update to 10.0.7.0
webMethods Managed File Transfer - update to 11.1 Server Fix2
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 7, 11.2.4 Fix Pack 2
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM App Connect Enterprise - addressed in versions 12.0.12.14, 13.0.3.1
AMQ Clients - update to 2023.Q4

External References

Related Security Bulletins