You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
CVE-2023-5072 - Denial of Service in JSON-Java versions up to and including 20230618. #789
@elrob Thanks for letting us know. As @johnjaylward posted, it seems to me that both vulnerabilities have been addressed and it is only necessary to cut a new release. I don't think any additional code changes are needed.
Reacted by Rob Speller, Ralph Plawetzki, Timo B, Stein-Erik Bjørnnes, Éamonn McManus and Pascal Wittmann
Release 20231013 is available, and is the earliest version that fixes the vulnerability. Have patience, it can take some time before it appears in the Maven repo.
@stleary I maintain a library that is used with both Java and Android, and we support JDK 7 (at the moment) mostly for Android's purposes (which uses org.json APIs). That requirement for us is going away shortly however, and I did find a workaround using maven profiles to default to 20231013, with an override to 20230618 when compiling on JDK 7 for the time being.
But Nexus IQ/Lifecycle says:
Recommendation
There is no non-vulnerable upgrade path for this component/package. We recommend investigating alternative > components or a potential mitigating control.
Version Affected
[20070829,20231013]
Any reason why SonaType would mark this specific version as vulnerable?
If there is to be another release for this, would it be possible to build with JDK 7? My maven profile workaround didn't work as I expected. If not, I'll understand, but I thought I'd ask in case it wasn't too difficult a request to entertain.
@johnjaylward Your idea sounds like a good approach and probably the least disruptive of the options. What do you think this would look like in the Maven repo?
Hi @johnjaylward,
please correct me if I'm wrong: CVE-2023-5072 is fixed in the 20230618.001 version, but is not fixed in the newest 20231013 version? We still have a vulnerablity in the project even though the newest 20231013 version is used. Thanks
@johnjaylward I have been thinking about that. Now that Hacktoberfest is over, is there any reason why we could not do a point release of 20231013 that is compiled with Java7?
Activity
johnjaylward commentedon Oct 13, 2023
Relates to #758, #759, #771, #772
stleary commentedon Oct 13, 2023
@elrob Thanks for letting us know. As @johnjaylward posted, it seems to me that both vulnerabilities have been addressed and it is only necessary to cut a new release. I don't think any additional code changes are needed.
timob9 commentedon Oct 13, 2023
@stleary can you already tell when the new release with the fix will be created?
Thank you very much!
stleary commentedon Oct 13, 2023
Yes, the new release will come out later today.
Bhavitha-Chava commentedon Oct 14, 2023
Hi @stleary, Could you pls let me know when we can expect the release? Is there a lower version that we can use to avoid hitting this vulnerability
Bump json from 20230618 to 20231013
stleary commentedon Oct 14, 2023
Release
20231013is available, and is the earliest version that fixes the vulnerability. Have patience, it can take some time before it appears in the Maven repo.lhazlewood commentedon Oct 15, 2023
@stleary was it strictly necessary to require JDK 8 for this release?
20230618was still JDK 7 compatible, but20231013is not.stleary commentedon Oct 15, 2023
@lhazlewood It was not strictly necessary.
How important is this to you?
What version of Java do you use?
Can you upgrade to Java 8?
stleary commentedon Oct 15, 2023
@elrob @TimoBuechert Release
20231013is now available in the Maven public repository.lhazlewood commentedon Oct 15, 2023
@stleary I maintain a library that is used with both Java and Android, and we support JDK 7 (at the moment) mostly for Android's purposes (which uses
org.jsonAPIs). That requirement for us is going away shortly however, and I did find a workaround using maven profiles to default to20231013, with an override to20230618when compiling on JDK 7 for the time being.PayBas commentedon Oct 16, 2023
Haven't tested it thoroughly yet, but our main issue is that
20231013seems to be included in the vulnerable versions in our Nexus Lifecycle tool:Not sure if it's an administration error, or if they feel that
20231013doesn't actually fix the vulnerability.I'll try to contact SonaType to see whats up.
Update: opened support ticket:
Update 2: apparently there's a dedicated place to submit corrections. So I've done so.
https://ossindex.sonatype.org/component/pkg:maven/org.json/json@20231013 will hopefully no longer be marked as vulnerable soon.
stleary commentedon Oct 16, 2023
@PayBas Thanks for checking. Perhaps they found a different way to recreate the problem.
lhazlewood commentedon Oct 16, 2023
If there is to be another release for this, would it be possible to build with JDK 7? My maven profile workaround didn't work as I expected. If not, I'll understand, but I thought I'd ask in case it wasn't too difficult a request to entertain.
8 remaining items
stleary commentedon Oct 17, 2023
@johnjaylward Your idea sounds like a good approach and probably the least disruptive of the options. What do you think this would look like in the Maven repo?
johnjaylward commentedon Oct 17, 2023
Should add the point releases under the java 8 releases
in Maven it should show:
nathan454 commentedon Oct 25, 2023
@stleary When can we expect backport for 20230618 ? I think @johnjaylward approach sounds ok
stleary commentedon Oct 25, 2023
@nathan454 Are you working on the same project as @lhazlewood, or is this a new request?
nathan454 commentedon Oct 25, 2023
new request
I'm also using this version and I support a library that needs to maintain support for java 7
johnjaylward commentedon Oct 25, 2023
Why is there a requirement for Java 7? Is this for older Android support, or some other reason?
alenamor7 commentedon Nov 8, 2023
Hi @johnjaylward,
please correct me if I'm wrong: CVE-2023-5072 is fixed in the 20230618.001 version, but is not fixed in the newest 20231013 version? We still have a vulnerablity in the project even though the newest 20231013 version is used. Thanks
johnjaylward commentedon Nov 8, 2023
20231013 should be the fixed version. we decided to NOT point release 20230618 at this time.
stleary commentedon Nov 8, 2023
@johnjaylward I have been thinking about that. Now that Hacktoberfest is over, is there any reason why we could not do a point release of
20231013that is compiled with Java7?johnjaylward commentedon Nov 8, 2023
I don't see an issue with it. Would just need to update the deployment yml to compile to java7
stleary commentedon Jan 19, 2025
Closing due to issue resolved