CVE-2023-7272 in org.eclipse.parsson 1.1.7

[hohwille]

Criticality:

high (8.7)

CVE-Link or steps to reproduce:

https://nvd.nist.gov/vuln/detail/cve-2023-7272
https://ossindex.sonatype.org/vulnerability/CVE-2023-7272?component-type=maven&component-name=org.glassfish%2Fjavax.json&utm_source=ossindex-client&utm_medium=integration&utm_content=1.7.0

Dependency

IDEasy/pom.xml

Line 47 in 2ef8843

<version>1.1.7</version>

[hohwille]

Problem: currently we have the latest version of that artifact in use
https://repo1.maven.org/maven2/org/eclipse/parsson/parsson/
so we have to wait until a security fix of parson is release so that we can update to that version.

[julia-cap]

Hi @hohwille,
According to the links provided in the description and here or here, the mentioned CVE relates to Eclipse Parsson versions before 1.0.4 and 1.1.3. According to this page on security.snyk.io version 1.1.7 has no vulnerabilities.

As we have Parsson version 1.1.7 in our project, is this issue obsolete?

[samuelkos17]

Seems to be of no concern to us, since we use Parsson version 1.1.9 so I guess we can close this issue