Bug 2256063 (CVE-2023-51074) - CVE-2023-51074 json-path: stack-based buffer overflow in Criteria.parse method
Summary: CVE-2023-51074 json-path: stack-based buffer overflow in Criteria.parse method
Keywords:
Status: NEW
Alias: CVE-2023-51074
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Sayan Biswas
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2256064
TreeView+ depends on / blocked
 
Reported: 2023-12-28 06:06 UTC by TEJ RATHI
Modified: 2024-07-20 08:28 UTC (History)
95 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A stack overflow vulnerability was found in the Criteria.parse() method in json-path. This issue occurs due to an uncontrolled recursion caused by specially crafted input, leading to a stack overflow. This vulnerability has the potential to trigger a crash, resulting in a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:0789 0 None None None 2024-02-12 16:02:20 UTC
Red Hat Product Errata RHSA-2024:0792 0 None None None 2024-02-12 17:38:06 UTC
Red Hat Product Errata RHSA-2024:2707 0 None None None 2024-05-06 14:10:31 UTC
Red Hat Product Errata RHSA-2024:3527 0 None None None 2024-05-30 20:25:37 UTC

Description TEJ RATHI 2023-12-28 06:06:48 UTC 
json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

https://github.com/json-path/JsonPath/issues/973
Comment 12 Patrick Del Bello 2024-01-24 14:34:13 UTC 
Downgrading this flaw to Moderate impact, especially to match NVD CVSS and also our impact rating which, as explained in the statement section, there is a very specific scenario for this flaw to be explored.
Comment 14 errata-xmlrpc 2024-02-12 16:02:16 UTC 
This issue has been addressed in the following products:

  RHBOAC camel-quarkus 3 (camel-4.0/quarkus-3.2)

Via RHSA-2024:0789 https://access.redhat.com/errata/RHSA-2024:0789
Comment 15 errata-xmlrpc 2024-02-12 17:38:01 UTC 
This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.20.5

Via RHSA-2024:0792 https://access.redhat.com/errata/RHSA-2024:0792
Comment 20 errata-xmlrpc 2024-05-06 14:10:27 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.4.0 for Spring Boot

Via RHSA-2024:2707 https://access.redhat.com/errata/RHSA-2024:2707
Comment 22 errata-xmlrpc 2024-05-30 20:25:31 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.7.0

Via RHSA-2024:3527 https://access.redhat.com/errata/RHSA-2024:3527
Note You need to log in before you can comment on or make changes to this bug.