Deserialization in Apache Johnzon
CVE-2023-33008
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.014 (72.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.014 · change: -0.000
Affected products
- Apache Johnzon
- Apache Software Foundation Johnzon — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l (vendor-advisory, Mailing List, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-33008?
- CVE-2023-33008 is a medium-severity vulnerability in Apache Johnzon, classified under Deserialization of Untrusted Data. CVSS score: 5.3/10. Published 2023-07-07.
- How severe is CVE-2023-33008?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-33008 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.