CVE-2021-31684
Fixed in a distro release EPSS 2%
A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.
Products: json-smart_project json-smart-v1, json-smart_project json-smart-v2, oracle utilities_framework
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | net.minidev:json-smart | 1.3.3 |
| Maven | net.minidev:json-smart | 2.4.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | celeborn-0.5 | 0.5.4-r26 |
| Chainguard | celeborn-0.6 | 0.6.3-r7 |
| Chainguard | druid | 37.0.0-r56 |
| Chainguard | druid | 37.0.0-r14 |
| Chainguard | druid | 34.0.0-r6 |
| Chainguard | hadoop-client-modules | 3.3.6-r7 |
| Chainguard | spark-3.5-scala-2.12 | no fix |
| Chainguard | spark-3.5-scala-2.13 | no fix |
| Chainguard | thingsboard | 3.7-r4 |
| Chainguard | thingsboard-tb-js-executor | 3.7-r4 |
| Chainguard | thingsboard-tb-mqtt-transport | 3.7-r4 |
| Chainguard | thingsboard-tb-node | 3.7-r4 |
| Chainguard | thingsboard-tb-web-ui | 3.7-r4 |
| Debian 10 | json-smart | 2.2-2+deb10u1 |
| Debian 12 | json-smart | 2.2-2+deb12u1 |
| Debian 13 | json-smart | 2.5.1-1 |
| Debian 14 | json-smart | 2.5.1-1 |
| Ubuntu 18.04 LTS | json-smart | 2.2-2ubuntu0.18.04.1 |
| Ubuntu 20.04 LTS | json-smart | 2.2-2ubuntu0.20.04.1 |
| Ubuntu 22.04 LTS | json-smart | 2.2-2ubuntu0.22.04.1 |
| Wolfi | celeborn-0.6 | 0.6.3-r7 |
| Wolfi | druid | 37.0.0-r14 |
| Wolfi | druid | 34.0.0-r6 |
| Wolfi | druid | 37.0.0-r56 |
| Wolfi | thingsboard | 3.7-r4 |
| Wolfi | thingsboard-tb-js-executor | 3.7-r4 |
| Wolfi | thingsboard-tb-mqtt-transport | 3.7-r4 |
| Wolfi | thingsboard-tb-node | 3.7-r4 |
| Wolfi | thingsboard-tb-web-ui | 3.7-r4 |