Deserialization in Apache Johnzon
CVE-2023-33008
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.
Vulnerability class: Insecure Deserialization
EPSS: 0.015 (70.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Apache Johnzon
- Apache Software Foundation Johnzon — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-33008?
- CVE-2023-33008 is a medium-severity vulnerability in Apache Johnzon, classified under Deserialization of Untrusted Data. CVSS score: 5.3/10. Published 2023-07-07.
- How severe is CVE-2023-33008?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-33008 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.