Описание
Hash collision in typelevel jawn
Impact
Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:
Affected implementations include:
org.http4s::http4s-play-jsonorg.typelevel :: jawn-ast(< 0.8.0)org.typelevel :: jawn-play(discontinued)org.typelevel :: jawn-rojoma(discontinued)org.typelevel :: jawn-spray(discontinued)
Unaffected implementations include:
io.argonaut :: argonaut-jawnio.circe :: circe-parserorg.typelevel :: jawn-ast(>= 0.8.0)org.typelevel :: jawn-json4s(discontinued)org.typelevel :: jawn-argonaut(discontinued)
Patches
jawn-parser-1.3.2 fixes the issue.
Workarounds
Override objectContext() to use a collision-safe collection. See the patch for an example in both SimpleFacade and MutableFacade.
References
Credits
- @kag0, for the report and the patch
For more information
If you have any questions or comments about this advisory:
- Open an issue in typelevel/jawn
- E-mail a maintainer:
Пакеты
org.typelevel:jawn-parser_0.25
Отсутствует
org.typelevel:jawn-parserg
Отсутствует
org.typelevel:jawn-parser_0.27
Отсутствует
org.typelevel:jawn-parser_2.10
Отсутствует
org.typelevel:jawn-parser_2.11
Отсутствует
org.typelevel:jawn-parser_2.12
< 1.3.2
1.3.2
org.typelevel:jawn-parser_2.13
< 1.3.2
1.3.2
org.typelevel:jawn-parser_2.13.0-M5
Отсутствует
org.typelevel:jawn-parser_2.13.0-RC1
Отсутствует
org.typelevel:jawn-parser_2.13.0-RC2
Отсутствует
org.typelevel:jawn-parser_2.13.0-RC3
Отсутствует
org.typelevel:jawn-parser_3
< 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-M1
Отсутствует
org.typelevel:jawn-parser_3.0.0-M2
Отсутствует
org.typelevel:jawn-parser_3.0.0-M3
Отсутствует
org.typelevel:jawn-parser_3.0.0-RC1
Отсутствует
org.typelevel:jawn-parser_3.0.0-RC2
Отсутствует
org.typelevel:jawn-parser_3.0.0-RC3
Отсутствует
Связанные уязвимости
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
Jawn is an open source JSON parser. Extenders of the `org.typelevel.ja ...
