CVE-2024-57699

[github-actions]

A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. ...

https://avd.aquasec.com/nvd/cve-2024-57699

A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.

Projects:

• accredited-programmes-and-oasys
• approved-premises-and-delius
• approved-premises-and-oasys
• assessment-summary-and-delius
• breach-notice-and-delius
• cas2-and-delius
• cas3-and-delius
• common-platform-and-delius
• court-case-and-delius
• create-and-vary-a-licence-and-delius
• custody-key-dates-and-delius
• justice-email-and-delius
• make-recall-decisions-and-delius
• manage-offences-and-delius
• manage-pom-cases-and-delius
• manage-supervision-and-delius
• pre-sentence-reports-to-delius
• prison-case-notes-to-probation
• prison-custody-status-to-delius
• prison-identifier-and-delius
• refer-and-monitor-and-delius
• tier-to-delius
• unpaid-work-and-delius
• workforce-allocations-to-delius

Locations:

• net.minidev:json-smart:2.5.1 (app/libs/json-smart-2.5.1.jar)

References:

• https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699
• https://github.com/netplex/json-smart-v2
• CVE-2024-57699 raised against 2.5.0...2.5.1 netplex/json-smart-v2#232
• fix CVE-2024-57699 for predefined parsers netplex/json-smart-v2#233
• Expected release date for 2.5.2? netplex/json-smart-v2#236
• https://github.com/netplex/json-smart-v2/releases/tag/2.5.2
• https://nvd.nist.gov/vuln/detail/CVE-2024-57699
• https://nvd.nist.gov/vuln/detail/cve-2023-1370