Bug 2359604 (CVE-2025-3588)

Summary:	CVE-2025-3588 jsonschema2pojo: joelittlejohn jsonschema2pojo JSON File SchemaRule.java apply stack-based overflow
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chfoley, darran.lofthouse, dkreling, dosoudil, eric.wittmann, fjuma, gmalinko, istudens, ivassile, iweiss, janstey, lgao, mosmerov, msochure, msvehla, nipatil, nwallace, pantinor, pdelbell, pesilva, pjindal, pmackay, rkubis, rstancel, rstepani, smaestri, swoodman, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in jsonschema2pojo, specifically in the apply function within SchemaRule.java. The issue leads to a stack-based buffer overflow, requiring local system access for exploitation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-04-14 21:01:10 UTC

A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.