CVE-2023-33008
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
A vulnerability in Apache Johnzon related to the deserialization of untrusted data allows an attacker to input large numbers in JSON format, potentially leading to slow conversion and Denial of Service risk.
Risk Assessment
The organization may be exposed to Denial of Service attacks that could slow down or block services using Apache Johnzon.
Recommendation
It is recommended to upgrade to Apache Johnzon version 1.2.21 or later to take advantage of the introduced scale limit for BigDecimal.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.