Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jettison | Jettison_project | * | 1.4.0 (including) |
| OCP-Tools-4.12-RHEL-8 | RedHat | jenkins-2-plugins-0:4.12.1686649756-1.el8 | * |
| OpenShift Developer Tools and Services for OCP 4.11 | RedHat | jenkins-2-plugins-0:4.11.1686831822-1.el8 | * |
| Red Hat AMQ Streams 2.4.0 | RedHat | jettison | * |
| Red Hat JBoss Enterprise Application Platform 7 | RedHat | jettison | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jettison-0:1.5.2-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap | * |
| Red Hat Single Sign-On 7 | RedHat | jettison | * |
| Red Hat Single Sign-On 7.6 for RHEL 7 | RedHat | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 8 | RedHat | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 9 | RedHat | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso | * |
| RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso76-openshift-rhel8:7.6-20 | * |
| RHINT Camel-Q 2.13.2 | RedHat | jettison | * |
| RHINT Camel-Springboot 3.20.1 | RedHat | jettison | * |
| RHPAM 7.13.1 async | RedHat | * | |
| Libjettison-java | Ubuntu | bionic | * |
| Libjettison-java | Ubuntu | esm-apps/bionic | * |
| Libjettison-java | Ubuntu | esm-apps/xenial | * |
| Libjettison-java | Ubuntu | focal | * |
| Libjettison-java | Ubuntu | jammy | * |
| Libjettison-java | Ubuntu | kinetic | * |
| Libjettison-java | Ubuntu | mantic | * |
| Libjettison-java | Ubuntu | trusty | * |
| Libjettison-java | Ubuntu | xenial | * |