René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"WS-2017-3805 (High) detected in json-20160212.jar","articleBody":"## WS-2017-3805 - High Severity Vulnerability\n\u003cdetails\u003e\u003csummary\u003e\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20\u003e Vulnerable Library - \u003cb\u003ejson-20160212.jar\u003c/b\u003e\u003c/p\u003e\u003c/summary\u003e\n\n\u003cp\u003eJSON is a light-weight, language independent, data interchange format.\n\t\tSee http://www.JSON.org/\n\n\t\tThe files in this package implement JSON encoders/decoders in Java.\n\t\tIt also includes the capability to convert between JSON and XML, HTTP\n\t\theaders, Cookies, and CDL.\n\n\t\tThis is a reference implementation. There is a large number of JSON packages\n\t\tin Java. Perhaps someday the Java community will standardize on one. Until\n\t\tthen, choose carefully.\n\n\t\tThe license includes this restriction: \"The software shall be used for good,\n\t\tnot evil.\" If your conscience cannot live with that, then choose a different\n\t\tpackage.\u003c/p\u003e\n\u003cp\u003eLibrary home page: \u003ca href=\"https://github.com/douglascrockford/JSON-java\"\u003ehttps://github.com/douglascrockford/JSON-java\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003ePath to dependency file: /pom.xml\u003c/p\u003e\n\u003cp\u003ePath to vulnerable library: /canner/.m2/repository/org/json/json/20160212/json-20160212.jar\u003c/p\u003e\n\u003cp\u003e\n\nDependency Hierarchy:\n  - :x: **json-20160212.jar** (Vulnerable Library)\n\u003cp\u003eFound in base branch: \u003cb\u003emaster\u003c/b\u003e\u003c/p\u003e\n\u003c/p\u003e\n\u003c/details\u003e\n\u003cp\u003e\u003c/p\u003e\n\u003cdetails\u003e\u003csummary\u003e\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20\u003e Vulnerability Details\u003c/summary\u003e\n\u003cp\u003e  \n  \nAffected versions of JSON In Java are vulnerable to Denial of Service (DoS) when trying to initialize a JSONArray object and the input is [. This will cause the jvm to crash with StackOverflowError due to non-cyclical stack overflow.\n\n\u003cp\u003ePublish Date: 2017-10-30\n\u003cp\u003eURL: \u003ca href=https://github.com/stleary/JSON-java/commit/ed8745cd634f3276b7f7bef4bf0f49987c83256d\u003eWS-2017-3805\u003c/a\u003e\u003c/p\u003e\n\u003c/p\u003e\n\u003c/details\u003e\n\u003cp\u003e\u003c/p\u003e\n\u003cdetails\u003e\u003csummary\u003e\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20\u003e CVSS 3 Score Details (\u003cb\u003e7.5\u003c/b\u003e)\u003c/summary\u003e\n\u003cp\u003e\n\nBase Score Metrics:\n- Exploitability Metrics:\n  - Attack Vector: Network\n  - Attack Complexity: Low\n  - Privileges Required: None\n  - User Interaction: None\n  - Scope: Unchanged\n- Impact Metrics:\n  - Confidentiality Impact: None\n  - Integrity Impact: None\n  - Availability Impact: High\n\u003c/p\u003e\nFor more information on CVSS3 Scores, click \u003ca href=\"https://www.first.org/cvss/calculator/3.0\"\u003ehere\u003c/a\u003e.\n\u003c/p\u003e\n\u003c/details\u003e\n\u003cp\u003e\u003c/p\u003e\n\u003cdetails\u003e\u003csummary\u003e\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/suggested_fix.png' width=19 height=20\u003e Suggested Fix\u003c/summary\u003e\n\u003cp\u003e\n\n\u003cp\u003eType: Upgrade version\u003c/p\u003e\n\u003cp\u003eRelease Date: 2017-10-30\u003c/p\u003e\n\u003cp\u003eFix Resolution: 20180130\u003c/p\u003e\n\n\u003c/p\u003e\n\u003c/details\u003e\n\u003cp\u003e\u003c/p\u003e\n\n***\nStep up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)","author":{"url":"https://github.com/mend-bolt-for-github[bot]","@type":"Person","name":"mend-bolt-for-github[bot]"},"datePublished":"2023-01-07T01:22:17.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/6/browserstack-local-java/issues/6"}