CVE-2024-21634: Ion Java StackOverflow vulnerability
Impact
A potential denial-of-service issue exists in ion-java for applications that use ion-java to:
Deserialize Ion text encoded data, or Deserialize Ion text or binary encoded data into the IonValue model and then invoke certain IonValue methods on that in-memory representation.
An actor could craft Ion data that, when loaded by the affected application and/or processed using the IonValue model, results in a StackOverflowError originating from the ion-java library.
Impacted versions: <1.10.5
Patches
The patch is included in ion-java >= 1.10.5.
Workarounds
Do not load data which originated from an untrusted source or that could have been tampered with. Only load data you trust.
----
If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
[1] https://aws.amazon.com/security/vulnerability-reporting
Other sources
Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then invoke certain IonValue methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the IonValue model, results in a StackOverflowError originating from the ion-java library. The patch is included in ion-java 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.
— Red Hat
Amazon Ion is vulnerable to a denial of service, caused by a stack-based overflow in ion-java for applications. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.amazon.ion:ion-javato a version that resolves this vulnerability.Fixed in 1.10.5 - Upgrade
Upgrade
ion-javato a version that resolves this vulnerability.Fixed in 1.10.5 - Compensating control
Do not load Ion data that originated from an untrusted source or that could have been tampered with.
- Compensating control
As a workaround, deserialize Ion text (encoded) data only from trusted sources, or deserialize Ion text or binary encoded data into the IonValue model and invoke the affected IonValue methods only on that in-memory representation derived from trusted data.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21634?
CVE-2024-21634 is categorized as a potential denial-of-service vulnerability.
How do I fix CVE-2024-21634?
To mitigate CVE-2024-21634, update to ion-java version 1.10.5 or later.
Which software is affected by CVE-2024-21634?
CVE-2024-21634 affects Amazon Ion and its Java library ion-java versions prior to 1.10.5.
Can CVE-2024-21634 impact applications using IBM Cognos Controller?
Yes, CVE-2024-21634 can impact IBM Cognos Controller versions 11.0.0 to 11.0.1 if they utilize ion-java.
What methods in IonValue are associated with CVE-2024-21634?
CVE-2024-21634 arises when certain IonValue methods are invoked after deserializing Ion text or binary data.