CVE-2022-40149: Stack Buffer Overflow in Jettison
A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.
Other sources
jettison-json Jettison is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially-crafted XML or JSON data, a remote authenticated attacker could exploit this vulnerability to causes the parser to crash, and results in a denial of service condition.
— IBM
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is vulnerability CVE-2022-40149?
Vulnerability CVE-2022-40149 is a stack-based buffer overflow vulnerability in Jettison, which can lead to a crash when parsing untrusted XML or JSON data.
How does vulnerability CVE-2022-40149 impact users?
Vulnerability CVE-2022-40149 can be exploited by attackers to supply malicious content that causes the parser to crash, resulting in a denial of service.
Which software versions are affected by vulnerability CVE-2022-40149?
Software versions 2-plugins-0:4.11.1686831822-1.el8 and 2-plugins-0:4.12.1686649756-1.el8 of Jenkins, as well as versions 0:1.5.2-1.redhat_00002.1.el8ea, 0:1.5.2-1.redhat_00002.1.el9ea, and 0:1.5.2-1.redhat_00002.1.el7ea of eap7-jettison are affected by vulnerability CVE-2022-40149.
How severe is vulnerability CVE-2022-40149?
Vulnerability CVE-2022-40149 has a severity rating of high, with a CVSS severity value of 7.
How can I mitigate vulnerability CVE-2022-40149?
To mitigate vulnerability CVE-2022-40149, it is recommended to apply the provided patches or updates for the affected software versions.