Allocation of Resources Without Limits or Throttling in JSON-java - CVE-2023-5072

Vulnerability identifier: #VU82276

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-5072

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

JSON-java
IBM Security Guardium
IBM i Modernization Engine for Lifecycle Integration
DataPower Operations Dashboard
Oracle Banking Platform
Oracle Business Intelligence Enterprise Edition
Oracle Communications Policy Management
Oracle Banking Digital Experience
ObjectScale
Storage Copy Data Management
IBM Cloud Pak for Watson AIOps
IBM Business Automation Manager Open Editions
Maximo Application Suite - IoT Component
IBM MQ Appliance
webMethods BPM
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
Red Hat Integration Camel-K
Oracle Banking Enterprise Default Management
Red Hat Integration Camel Extensions for Quarkus
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Loans Servicing
Red Hat build of Quarkus
Jira Service Management Server
Jira Service Management Data Center
IBM Intelligent Operations Center
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
Oracle Communications WebRTC Session Controller
IBM Maximo Application Suite
Jira Software Data Center
WebSphere Remote Server
Oracle Life Sciences Empirica Signal
Oracle SD-WAN Edge
Bamboo Server
IBM Integration Bus
Infrastructure Technology
Oracle Hyperion Financial Data Quality Management
Oracle Identity Manager Connector
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Oracle Banking APIs
Primavera P6 Enterprise Project Portfolio Management
IBM Automation Decision Services
Oracle Communications Cloud Native Core Network Exposure Function
IBM Process Mining
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Sterling Connect:Direct Web Services
Datastax Enterprise with IBM
Bitbucket Data Center
HPE Telco IP Mediation E-Media
IBM MQ
IBM Spectrum Protect Plus
EMC Data Protection Advisor
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
Password Manager Pro
IBM Db2 Web Query for i
Oracle Business Process Management Suite
Oracle Banking Cash Management
Oracle Banking Liquidity Management
Oracle Banking Virtual Account Management
Oracle Banking Origination
Stream Analytics
AMQ Streams
Oracle WebLogic Server
Primavera Gateway
AMQ Broker
Fuse
Bitbucket Server
Oracle Communications Convergence
Red Hat Camel for Spring Boot
IBM App Connect Enterprise
Oracle GraalVM for JDK
Oracle Solaris Cluster
Crowd Server
Confluence Server
Cloud Foundry UAA
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Jira Software Server
Oracle Hyperion Calculation Manager
Analysis Model API
Hyperion Planning
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Siebel CRM Integration
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Service Bus
Oracle GraalVM Enterprise Edition
Oracle WebCenter Content
Oracle GoldenGate
Oracle Database Server
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Unified Data Repository
OpenView Performance Manager (OVPM)
EMC Integrated Data Protection Appliance

Install updates from vendor's website.

JSON-java - update to 20231013
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.5
DataPower Operations Dashboard - update to 1.0.20.0
Red Hat Integration Camel-K - update to 1.10.5
AMQ Streams - addressed in versions 2.5.2, 2.6.0
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.9
Red Hat build of Quarkus - update to 3.2.9
Red Hat Camel for Spring Boot - addressed in versions 3.20.4, 4.0.2
Jira Service Management Server - addressed in versions 4.20.28, 5.4.12
Jira Service Management Data Center - addressed in versions 4.20.28, 5.4.12
Crowd Server - addressed in versions 5.0.8, 5.1.6, 5.2.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Sterling Control Center - update to 6.2.1.0.15
Confluence Server - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.2
Confluence Data Center - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.2, 8.7.1
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.5
IBM Maximo Application Suite - addressed in versions 8.11.0, 8.11.2
Jira Software Data Center - addressed in versions 9.4.16, 9.12.1
Jira Software Server - addressed in versions 9.4.16, 9.12.1
Bamboo Server - addressed in versions 9.2.7, 9.3.5, 9.4.2
IBM App Connect Enterprise - addressed in versions 11.0.0.24, 12.0.11.1
Analysis Model API - update to 11.13.0
IBM Automation Decision Services - update to 23.0.1 IF005
Cloud Foundry UAA - update to 76.23.0
OpenView Performance Manager (OVPM) - update to T0684V01^ABL
ObjectScale - update to 1.4.0
IBM Process Mining - update to 1.14.3
Storage Copy Data Management - update to 2.2.25.0
EMC Integrated Data Protection Appliance - update to 2.7.6
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.3
IBM Cloud Pak for Watson AIOps - update to 4.4.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.1
App Connect Enterprise Certified Container - addressed in versions 5.0.14, 11.2.0
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.24, 6.2.0.23, 6.3.0.7
Datastax Enterprise with IBM - addressed in versions 6.8.63, 6.9.20
AMQ Broker - addressed in versions 7.10.7, 7.11.7
Fuse - update to 7.13.0
Bitbucket Data Center - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
Bitbucket Server - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
IBM Business Automation Manager Open Editions - update to 8.0.5
HPE Telco IP Mediation E-Media - update to 8.5.0
RSA Authentication Manager - update to 8.7 SP2 Patch 2
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
IBM MQ - addressed in versions 9.1.0.19, 9.2.0.21, 9.3.0.15, 9.3.4.1
IBM MQ Appliance - addressed in versions 9.3.0.15, 9.3.4.1
IBM Spectrum Protect Plus - update to 10.1.6.4
webMethods BPM - update to 11.1 Fix 1
IBM Cognos Analytics - addressed in versions 11.2.4 FP3, 12.0.3
EMC Data Protection Advisor - update to 19.10 PB22
Dell Data Protection Central - update to 19.11.0-2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.27, 23.0.1.5
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
IBM Robotic Process Automation - addressed in versions 21.0.7.15, 23.0.16
IBM Observability with Instana - update to 274
Password Manager Pro - update to 12401

• https://github.com/stleary/JSON-java/issues/771
• https://github.com/stleary/JSON-java/issues/758

• Denial of service in JSON-Java
• Denial of service in Cloud Foundry UAA
• Multiple vulnerabilities in Red Hat Build of Apache Camel for Quarkus 3.2
• IBM Maximo Application Suite - Monitor Component update for JSON-java
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
• Atlassian Bamboo Data Center and Server update for third-party applications
• Atlassian Jira Service Management Data Center and Server update for third-party software
• Atlassian Crowd Data Center and Server update for third-party software
• Atlassian Confluence Data Center and Server update for third-party software
• Atlassian Bitbucket Data Center and Server update for third-party software
• Denial of service in Jenkins Analysis Model API plugin
• Multiple vulnerabilities in Zoho Corporation Password Manager Pro
• Red Hat Integration Camel for Spring Boot update for JSON-java
• Multiple vulnerabilities in IBM Automation Decision Services
• IBM MQ update for JSON-java
• IBM MQ Appliance update for JSON-java
• IBM Process Mining update for JSON-java
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat Integration Camel-K 1.10
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle WebCenter Content
• Allocation of Resources Without Limits or Throttling in Oracle Service Bus
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in Oracle GraalVM for JDK
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications Convergence
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Allocation of resources without limits or throttling in IBM App Connect Enterprise and IBM Integration Bus
• Allocation of Resources Without Limits or Throttling in Oracle Hyperion Financial Data Quality Management
• Multiple vulnerabilities in Oracle Hyperion Calculation Manager
• Multiple vulnerabilities in Hyperion Planning
• Multiple vulnerabilities in Infrastructure Technology
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Allocation of resources without limits or throttling in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Allocation of resources without limits or throttling in DataPower Operations Dashboard
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM Db2 Web Query for i
• Multiple vulnerabilities in Red Hat Process Automation Manager 7.13
• Jira Software Data Center and Server update for json
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle Commerce Platform
• Allocation of Resources Without Limits or Throttling in Stream Analytics
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Allocation of Resources Without Limits or Throttling in Oracle Communications WebRTC Session Controller
• Multiple vulnerabilities in Oracle Life Sciences Empirica Signal
• Multiple vulnerabilities in Oracle Identity Manager Connector
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Banking Loans Servicing
• Allocation of Resources Without Limits or Throttling in Oracle Banking Enterprise Default Management
• Multiple vulnerabilities in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in HPE Telco IP Mediation E-Media
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in Data Protection Advisor
• Multiple vulnerabilities in AMQ Broker 7.11
• Multiple vulnerabilities in AMQ Broker 7.10
• Multiple vulnerabilities in Fuse 7.13
• Allocation of resources without limits or throttling in IBM Robotic Process Automation
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Siebel CRM Integration
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Dell ObjectScale
• Allocation of resources without limits or throttling in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in AMQ Streams 2.5
• Multiple vulnerabilities in Oracle Solaris Cluster
• Multiple vulnerabilities in HPE OpenView Performance Manager (OVPM)
• IBM B2B Sterling Integrator update for JSON-java
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring (UOCAM)
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM webMethods BPM(on prem)
• Allocation of Resources Without Limits or Throttling in Oracle GoldenGate
• Multiple vulnerabilities in IBM DataStax Enterprise