CVE-2022-40150: Stack Buffer Overflow in Jettison
A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.
Other sources
jettison-json Jettison is vulnerable to a denial of service, caused by an out of memory flaw. By sending a specially-crafted XML or JSON data, a remote authenticated attacker could exploit this vulnerability to causes the parser to crash, and results in a denial of service condition.
— IBM
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-40150?
CVE-2022-40150 is a vulnerability found in Jettison, where parsing untrusted XML or JSON data may lead to a crash, causing memory exhaustion and potentially supporting a denial of service attack.
How does CVE-2022-40150 affect Jettison?
CVE-2022-40150 affects Jettison by allowing an attacker to supply content in untrusted XML or JSON data that can crash the parser and exhaust memory, leading to a denial of service.
What is the severity of CVE-2022-40150?
The severity of CVE-2022-40150 is high, with a severity value of 7.
Which software versions are affected by CVE-2022-40150?
CVE-2022-40150 affects jettison-json version 2-plugins-0:4.11.1686831822-1.el8 up to version 2-plugins-0:4.12.1686649756-1.el8. It also affects various versions of eap7-jettison, rh-sso7-keycloak, Jettison, libjettison-java, and IBM Sterling External Authentication Server.
How can I fix CVE-2022-40150?
To fix CVE-2022-40150, it is recommended to update to the latest versions of the affected software or apply the patches provided by the vendors.