CVE Vulnerabilities

CVE-2022-21653

Inadequate Encryption Strength

Published: Jan 05, 2022 | Modified: Jan 12, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who dont override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Weakness

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected Software

Name Vendor Start Version End Version
Jawn Typelevel * 1.3.2 (excluding)
Jawn Ubuntu hirsute *
Jawn Ubuntu impish *
Jawn Ubuntu kinetic *
Jawn Ubuntu lunar *
Jawn Ubuntu trusty *
Jawn Ubuntu xenial *

Potential Mitigations

References