Hash collision in typelevel jawn
CVE-2022-21653

5.9MEDIUM

Key Information:

Vendor

Typelevel

Status
Jawn
Vendor
CVE Published:
5 January 2022

What is CVE-2022-21653?

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Affected Version(s)

jawn < 1.3.2

References

https://github.com/typelevel/jawn/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/typelevel/jawn/pull/390
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.