CVE-2023-5072 is a high-severity vulnerability affecting JSON-Java versions up to and including 20230618. This Denial of Service (DoS) vulnerability is caused by a bug in the parser, which can lead to indefinite amounts of memory being used. Systems using affected versions of JSON-Java, such as those running certain Jenkins plugins, could potentially be impacted by this vulnerability. The issue has been addressed in recent updates, so it is crucial for users to keep their software up-to-date to mitigate the risk.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, you should check if you're using JSON-Java versions up to and including 20230618. This vulnerability can cause a Denial of Service (DoS) due to a bug in the parser, leading to excessive memory usage. If you're using certain Jenkins plugins, such as the Analysis Model API Plugin 11.11.0 and earlier versions, you may also be affected, as these plugins bundle vulnerable versions of JSON-Java. Keep in mind that this issue can impact your entire system, not just the thread parsing the input.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to update your JSON-Java software to a version newer than 20230618. For Jenkins plugins, update to the fixed versions, such as Analysis Model API Plugin 11.13.0. Always keep your software up-to-date and follow best practices to maintain security.

Is CVE-2023-5072 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-5072 vulnerability, also known as Denial of Service in JSON-Java, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was added to the National Vulnerability Database on October 12, 2023. There is no specific due date or required action provided, but users are advised to update their software and refer to available advisories, solutions, and tools to address the vulnerability.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-770, which is related to the allocation of resources without limits or throttling that can lead to a Denial of Service attack. This issue has been addressed in recent updates.

For more details

CVE-2023-5072 is a significant vulnerability affecting JSON-Java, with potential consequences for systems using affected versions. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Openwall - Multiple vulnerabilities in Jenkins plugins

• GitHub - JSON-java Issue #758: Confusion between \0 and EOF can lead to OutOfMemoryError

• GitHub - JSON-java Issue #771: Logic to exclude object keys that are themselves objects is imperfect (1)