JSON-java
JSON-java copied to clipboard
stleary
CVE-2023-5072 - Denial of Service in JSON-Java versions up to and including 20230618.
https://nvd.nist.gov/vuln/detail/CVE-2023-5072
https://github.com/advisories/GHSA-rm7j-f5g5-27vv
@elrob Thanks for letting us know. As @johnjaylward posted, it seems to me that both vulnerabilities have been addressed and it is only necessary to cut a new release. I don't think any additional code changes are needed.
@stleary can you already tell when the new release with the fix will be created? Thank you very much!
Hi @stleary, Could you pls let me know when we can expect the release? Is there a lower version that we can use to avoid hitting this vulnerability
Release 20231013 is available, and is the earliest version that fixes the vulnerability. Have patience, it can take some time before it appears in the Maven repo.
@stleary was it strictly necessary to require JDK 8 for this release? 20230618 was still JDK 7 compatible, but 20231013 is not.
@lhazlewood It was not strictly necessary. How important is this to you? What version of Java do you use? Can you upgrade to Java 8?
@elrob @TimoBuechert Release 20231013 is now available in the Maven public repository.
@stleary I maintain a library that is used with both Java and Android, and we support JDK 7 (at the moment) mostly for Android's purposes (which uses org.json APIs). That requirement for us is going away shortly however, and I did find a workaround using maven profiles to default to 20231013, with an override to 20230618 when compiling on JDK 7 for the time being.
Haven't tested it thoroughly yet, but our main issue is that 20231013 seems to be included in the vulnerable versions in our Nexus Lifecycle tool:
Not sure if it's an administration error, or if they feel that 20231013 doesn't actually fix the vulnerability.
I'll try to contact SonaType to see whats up.
Update: opened support ticket:
https://nvd.nist.gov/vuln/detail/CVE-2023-5072 is marked as: "JSON-Java versions up to and including
20230618" The developers assert that is has been resolved in version20231013https://github.com/stleary/JSON-java/issues/789But Nexus IQ/Lifecycle says: Recommendation There is no non-vulnerable upgrade path for this component/package. We recommend investigating alternative > components or a potential mitigating control. Version Affected [20070829,20231013]
Any reason why SonaType would mark this specific version as vulnerable?
Update 2: apparently there's a dedicated place to submit corrections. So I've done so. https://ossindex.sonatype.org/component/pkg:maven/org.json/json@20231013 will hopefully no longer be marked as vulnerable soon.
@PayBas Thanks for checking. Perhaps they found a different way to recreate the problem.
If there is to be another release for this, would it be possible to build with JDK 7? My maven profile workaround didn't work as I expected. If not, I'll understand, but I thought I'd ask in case it wasn't too difficult a request to entertain.
@stleary it seems to have worked.
https://ossindex.sonatype.org/component/pkg:maven/org.json/json@20231013
This version of json has no known vulnerabilities! 🎉
The CVE still appears to be under analysis, but hopefully it will be cleared soon, too. https://nvd.nist.gov/vuln/detail/CVE-2023-5072
@lhazlewood Yes, this can be done. Will the same code in a different repo work for you?
@lhazlewood It has not been decided yet. Might be a different repo that is published to Maven and tracks JSON-Java but is Java 7 compatible, or #741 might be reverted, which could get complicated. Do you have any thoughts or concerns about either option?
@lhazlewood It has not been decided yet. Might be a different repo that is published to Maven and tracks JSON-Java but is Java 7 compatible, or #741 might be reverted, which could get complicated. Do you have any thoughts or concerns about either option?
I think it would be best if we could make a java6 branch based off the tag for release 20230618. Then we would backport any PRs that are related to a CVE (like #759 and #772). The version for the branch would stay at a base value of 20230618, but we could point release it for security fixes like 20230618.001 to issue a fix for this CVE.
The master branch could then stay as supporting Java 8+ while only minimal required changes happen on the java6 branch for security issues.
Does that work for you @stleary ?
@stleary , here is an example of what the PR would look like if we created the java6 branch in this repo
https://github.com/johnjaylward/JSON-java/pull/2
@johnjaylward Your idea sounds like a good approach and probably the least disruptive of the options. What do you think this would look like in the Maven repo?
Should add the point releases under the java 8 releases
in Maven it should show:
- 20231013 (java 8+)
- 20230618.001 (java6+ with latest security fixes)
- 20230618 (java 6+ without security fixes)
@stleary , here is an example of what the PR would look like if we created the
java6branch in this repo
@stleary When can we expect backport for 20230618 ? I think @johnjaylward approach sounds ok
@nathan454 Are you working on the same project as @lhazlewood, or is this a new request?
@nathan454 Are you working on the same project as @lhazlewood, or is this a new request?
new request I'm also using this version and I support a library that needs to maintain support for java 7
@nathan454 Are you working on the same project as @lhazlewood, or is this a new request?
new request I'm also using this version and I support a library that needs to maintain support for java 7
Why is there a requirement for Java 7? Is this for older Android support, or some other reason?
Hi @johnjaylward, please correct me if I'm wrong: CVE-2023-5072 is fixed in the 20230618.001 version, but is not fixed in the newest 20231013 version? We still have a vulnerablity in the project even though the newest 20231013 version is used. Thanks
20231013 should be the fixed version. we decided to NOT point release 20230618 at this time.
@johnjaylward I have been thinking about that. Now that Hacktoberfest is over, is there any reason why we could not do a point release of 20231013 that is compiled with Java7?