Allocation of Resources Without Limits or Throttling in JSON-java - CVE-2023-5072

Vulnerability identifier: #VU82276

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-5072

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
JSON-java
IBM Security Guardium
IBM i Modernization Engine for Lifecycle Integration
DataPower Operations Dashboard
Oracle Banking Platform
Oracle Business Intelligence Enterprise Edition
Oracle Communications Policy Management
Oracle Banking Digital Experience
ObjectScale
Storage Copy Data Management
IBM Cloud Pak for Watson AIOps
IBM Business Automation Manager Open Editions
Maximo Application Suite - IoT Component
IBM MQ Appliance
webMethods BPM
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
Red Hat Integration Camel-K
Oracle Banking Enterprise Default Management
Red Hat Integration Camel Extensions for Quarkus
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Loans Servicing
Red Hat build of Quarkus
Jira Service Management Server
Jira Service Management Data Center
IBM Intelligent Operations Center
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
Oracle Communications WebRTC Session Controller
IBM Maximo Application Suite
Jira Software Data Center
WebSphere Remote Server
Oracle Life Sciences Empirica Signal
Oracle SD-WAN Edge
Bamboo Server
IBM Integration Bus
Infrastructure Technology
Oracle Hyperion Financial Data Quality Management
Oracle Identity Manager Connector
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Oracle Banking APIs
Primavera P6 Enterprise Project Portfolio Management
IBM Automation Decision Services
Oracle Communications Cloud Native Core Network Exposure Function
IBM Process Mining
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Sterling Connect:Direct Web Services
Datastax Enterprise with IBM
Bitbucket Data Center
HPE Telco IP Mediation E-Media
IBM MQ
IBM Spectrum Protect Plus
EMC Data Protection Advisor
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
Password Manager Pro
IBM Db2 Web Query for i
Oracle Business Process Management Suite
Oracle Banking Cash Management
Oracle Banking Liquidity Management
Oracle Banking Virtual Account Management
Oracle Banking Origination
Stream Analytics
AMQ Streams
Oracle WebLogic Server
Primavera Gateway
AMQ Broker
Fuse
Bitbucket Server
Oracle Communications Convergence
Red Hat Camel for Spring Boot
IBM App Connect Enterprise
Oracle GraalVM for JDK
Oracle Solaris Cluster
Crowd Server
Confluence Server
Cloud Foundry UAA
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Jira Software Server
Oracle Hyperion Calculation Manager
Analysis Model API
Hyperion Planning
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Siebel CRM Integration
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Service Bus
Oracle GraalVM Enterprise Edition
Oracle WebCenter Content
Oracle GoldenGate
Oracle Database Server
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Unified Data Repository
OpenView Performance Manager (OVPM)
EMC Integrated Data Protection Appliance

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://github.com/stleary/JSON-java/issues/771
• https://github.com/stleary/JSON-java/issues/758