Uncontrolled Recursion in Codehaus Jettison - CVE-2023-1436

Vulnerability identifier: #VU75431

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-1436

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Codehaus Jettison
Oracle GoldenGate Studio
Red Hat Camel for Spring Boot
API Manager
IBM Data Risk Manager
GoldenGate Veridata
Oracle Banking Corporate Lending Process Management
Oracle Banking Trade Finance Process Management
Oracle Banking Liquidity Management
Oracle Banking Cash Management
Oracle Banking Virtual Account Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Supply Chain Finance
Oracle Retail Bulk Data Integration
API Gateway
JBoss Enterprise Application Platform
Oracle WebLogic Server
ObjectScale
Oracle Business Intelligence Enterprise Edition
Oracle FLEXCUBE Universal Banking
Oracle FLEXCUBE Private Banking
Oracle Siebel CRM
IBM Application Suite - IBM Asset Data Dictionary Component
Storage Copy Data Management
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
UrbanCode Build
Migration Toolkit for Runtimes
Oracle StorageTek Tape Analytics (STA)
Red Hat Integration Camel Extensions for Quarkus
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
Oracle Communications Converged Application Server - Service Controller
Jira Software Data Center
Oracle Middleware Common Libraries and Tools
Middleware Common Libraries and Tools
Enterprise Manager Base Platform
Enterprise Manager for Oracle Virtual Infrastructure
Netcool Operations Insight
IBM Process Mining
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling External Authentication Server
IBM Sterling Secure Proxy
Red Hat Migration Toolkit for Applications
IBM UrbanCode Release
CICS Transaction Gateway
Oracle Solaris Cluster
openSUSE Leap
Ubuntu
openEuler
SecureTransport
Red Hat Single Sign-On
PeopleSoft Enterprise PeopleTools
Oracle Documaker
Jira Software Server
Oracle FLEXCUBE Core Banking
IBM Qradar SIEM
JD Edwards EnterpriseOne Orchestrator
Identity Manager
Oracle Enterprise Manager Ops Center
Oracle Communications Billing and Revenue Management
Oracle Enterprise Manager for Fusion Middleware
Enterprise Manager for Oracle Database
IBM Disconnected Log Collector
Oracle Banking Corporate Lending
Oracle Retail Merchandising System
Oracle Banking Payments
Oracle Retail Sales Audit
Siebel CRM Integration
libjettison-java (Ubuntu package)
eap7-insights-java-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-glassfish-jaf (Red Hat package)
jettison-javadoc
jettison
eap7-jettison (Red Hat package)
eap7-glassfish-javamail (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-picketlink-bindings (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-activemq-artemis (Red Hat package)
jenkins (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-protostream (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
watsonx.data
IBM Cloud Pak System
IBM InfoSphere Information Server

Install updates from vendor's website.

Codehaus Jettison - update to 1.5.4
API Manager - update to May 2023
API Gateway - update to May 2023
ObjectScale - update to 1.3.0
Migration Toolkit for Runtimes - update to 1.2.3
IBM Data Risk Manager - update to 2.0.6.17
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.3
SecureTransport - update to 5.5-20230427
Dell Secure Connect Gateway - update to 5.16
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.1.4, 6.1.2.3, 6.2.0.0
JBoss Enterprise Application Platform - update to 7.4.12
Red Hat Single Sign-On - update to 7.6.5
Jira Software Server - addressed in versions 9.4.16, 9.9.0
Jira Software Data Center - addressed in versions 9.4.16, 9.9.0
JD Edwards EnterpriseOne Orchestrator - update to 9.2.8.0
Oracle FLEXCUBE Core Banking - update to 11.8.0
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
Oracle Banking Corporate Lending - update to 14.4
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
Oracle Siebel CRM - update to 23.8
libjettison-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.1-1ubuntu0.22.10.2, 1.5.3-1ubuntu0.1
eap7-insights-java-client (Red Hat package) - addressed in versions 1.0.9-1.redhat_00001.1.el7eap, 1.0.9-1.redhat_00001.1.el8eap, 1.0.9-1.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.0.9-1.redhat_00001.1.el7eap, 1.0.9-1.redhat_00001.1.el8eap, 1.0.9-1.redhat_00001.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.9
eap7-glassfish-jaf (Red Hat package) - addressed in versions 1.2.2-2.redhat_00002.1.el7eap, 1.2.2-2.redhat_00002.1.el8eap, 1.2.2-2.redhat_00002.1.el9eap
jettison-javadoc - update to 1.5.4-1
jettison - update to 1.5.4-1
eap7-jettison (Red Hat package) - addressed in versions 1.5.4-1.redhat_00002.1.el7eap, 1.5.4-1.redhat_00002.1.el8eap, 1.5.4-1.redhat_00002.1.el9eap
jettison-javadoc - update to 1.5.4-150200.3.7.1
jettison - update to 1.5.4-150200.3.7.1
eap7-glassfish-javamail (Red Hat package) - addressed in versions 1.6.7-2.redhat_00003.1.el7eap, 1.6.7-2.redhat_00003.1.el8eap, 1.6.7-2.redhat_00003.1.el9eap
Netcool Operations Insight - update to 1.6.10
IBM Disconnected Log Collector - update to 1.8.3
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-30.Final_redhat_00029.1.el7eap, 1.10.0-30.Final_redhat_00029.1.el8eap, 1.10.0-30.Final_redhat_00029.1.el9eap
IBM Process Mining - update to 1.14.0.0
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.17-1.Final_redhat_00001.1.el7eap, 1.15.17-1.Final_redhat_00001.1.el8eap, 1.15.17-1.Final_redhat_00001.1.el9eap
watsonx.data - update to 2.0.3
Storage Copy Data Management - update to 2.2.25.0
eap7-undertow (Red Hat package) - addressed in versions 2.2.25-3.SP3_redhat_00001.1.el7eap, 2.2.25-3.SP3_redhat_00001.1.el8eap, 2.2.25-3.SP3_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.3.6 iFix 1
Cloud Pak for Network Automation - update to 2.4.7
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-23.SP12_redhat_00013.1.el7eap, 2.5.5-23.SP12_redhat_00013.1.el8eap, 2.5.5-23.SP12_redhat_00013.1.el9eap
eap7-picketlink-bindings (Red Hat package) - addressed in versions 2.5.5-27.SP12_redhat_00016.1.el7eap, 2.5.5-27.SP12_redhat_00016.1.el8eap, 2.5.5-27.SP12_redhat_00016.1.el9eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-36.redhat_00014.1.el7eap, 2.7.1-36.redhat_00014.1.el8eap, 2.7.1-36.redhat_00014.1.el9eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-12.redhat_00048.1.el7eap, 2.16.0-12.redhat_00048.1.el8eap, 2.16.0-12.redhat_00048.1.el9eap
jenkins (Red Hat package) - addressed in versions 2.401.1.1686680404-3.el8, 2.401.1.1686831596-3.el8
eap7-hal-console (Red Hat package) - addressed in versions 3.3.18-1.Final_redhat_00001.1.el7eap, 3.3.18-1.Final_redhat_00001.1.el8eap, 3.3.18-1.Final_redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.5.2
Red Hat Camel for Spring Boot - addressed in versions 3.18.3 Patch 2, 3.20.1
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.53-1.Final_redhat_00001.1.el7eap, 4.0.53-1.Final_redhat_00001.1.el8eap, 4.0.53-1.Final_redhat_00001.1.el9eap
IBM Cloud Pak for Watson AIOps - update to 4.1.1
eap7-protostream (Red Hat package) - addressed in versions 4.3.5-2.Final_redhat_00003.1.el7eap, 4.3.5-2.Final_redhat_00003.1.el8eap, 4.3.5-2.Final_redhat_00003.1.el9eap
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
jenkins-2-plugins (Red Hat package) - addressed in versions 4.11.1686831822-1.el8, 4.13.1686680473-1.el8
eap7-hibernate (Red Hat package) - addressed in versions 5.3.30-1.Final_redhat_00001.1.el7eap, 5.3.30-1.Final_redhat_00001.1.el8eap, 5.3.30-1.Final_redhat_00001.1.el9eap
IBM Sterling External Authentication Server - addressed in versions 6.0.3.0 iFix 08, 6.1.0.0 iFix 04
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08
UrbanCode Build - update to 6.1.7.10
Red Hat Migration Toolkit for Applications - update to 6.2
IBM UrbanCode Release - update to 6.2.5.11
eap7-wildfly (Red Hat package) - addressed in versions 7.4.12-3.GA_redhat_00003.1.el7eap, 7.4.12-3.GA_redhat_00003.1.el8eap, 7.4.12-3.GA_redhat_00003.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
CICS Transaction Gateway - addressed in versions 9.1.0.3, 9.2.0.2, 9.3.0.0
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.9-1.redhat_00001.1.el7sso, 18.0.9-1.redhat_00001.1.el8sso, 18.0.9-1.redhat_00001.1.el9sso

• https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/

• Denial of service in Jettison
• SUSE update for jettison
• Multiple vulnerabilities in Axway SecureTransport
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Uncontrolled recursion in IBM Process Mining
• Uncontrolled recursion in IBM InfoSphere Information Server
• Multiple vulnerabilities in CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in Axway API Gateway and API Manager
• OpenShift Developer Tools and Services for OCP 4.13 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 2.13
• Ubuntu update for libjettison-java
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Uncontrolled Recursion in Oracle Communications Converged Application Server - Service Controller
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Documaker
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Retail Bulk Data Integration
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Red Hat Single Sign-On 7.6.5 security update on RHEL 9
• Red Hat Single Sign-On 7.6.5 security update on RHEL 8
• Red Hat Single Sign-On 7.6.5 security update on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in Oracle FLEXCUBE Core Banking
• Multiple vulnerabilities in GoldenGate Veridata
• Multiple vulnerabilities in Oracle GoldenGate Studio
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Identity Manager
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM UrbanCode Build
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Oracle Siebel CRM
• Uncontrolled Recursion in Oracle Enterprise Manager Ops Center
• Uncontrolled Recursion in Enterprise Manager for Oracle Virtual Infrastructure
• Uncontrolled Recursion in Enterprise Manager for Oracle Database
• Uncontrolled Recursion in Oracle Enterprise Manager for Fusion Middleware
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Uncontrolled Recursion in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Uncontrolled Recursion in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler 20.03 LTS SP1 update for jettison
• openEuler 20.03 LTS SP3 update for jettison
• openEuler 22.03 LTS update for jettison
• openEuler 22.03 LTS SP1 update for jettison
• openEuler 22.03 LTS SP2 update for jettison
• Jira Software Data Center and Server update for jettison
• openEuler 20.03 LTS SP4 update for jettison
• Uncontrolled Recursion in Oracle Retail Sales Audit
• Uncontrolled Recursion in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle StorageTek Tape Analytics (STA)
• Multiple vulnerabilities in Oracle Solaris Cluster
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• IBM watsonx.data update for Jettison
• IBM watsonx.data update for FasterXML jackson-databind
• IBM watsonx.data update for Jettison
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Banking Payments
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending
• Multiple vulnerabilities in Siebel CRM Integration