Input validation error in JSON-lib - CVE-2024-47855

Vulnerability identifier: #VU98745

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-47855

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in util/JSONTokener.java when handling comments. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

JSON-lib
Jenkins
Jenkins LTS
openSUSE Leap
openEuler
json-lib
jenkins-json-lib
json-lib-help
json-lib-javadoc

Install updates from vendor's website.

JSON-lib - update to 3.1.0
Jenkins - update to 2.487
Jenkins LTS - update to 2.479.2
json-lib - update to 2.4-23
jenkins-json-lib - update to 2.4-23
json-lib-help - update to 2.4-23
jenkins-json-lib - update to 2.4-150200.3.7.1
json-lib - update to 2.4-150200.3.7.1
json-lib-javadoc - update to 2.4-150200.3.7.1

• https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e
• https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0

• Improper input validation in JSON-lib
• SUSE update for json-lib
• openEuler update for json-lib
• Denial of service in Jenkins and Jenkins LTS