CVE-2023-4043mediumCWE-20CWE-834

CVE-2023-4043: fallo de gravedad media en Eclipse Foundation Parsson

Parsson DoS when parsing numbers from untrusted sources

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Parsson+ Monitorear org.eclipse.parsson:project

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.9%
In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Eclipse Foundation · Parsson
CVEs relacionadas — Eclipse Foundation Parsson

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-7272HIGHEclipse Parsson stack overflow with deeply nested objectsEPSS 0.6%