CVE-2023-5072 - Vulnerability with hawtio

[sasikumar-ms7]

New vulnerability CVE-2023-5072 is identified with latest stable version of hawtio 2.17.6. This vulnerability is from org.json:json-20230227. Please upgrade to json:20231013 to fix this vulnerability.

Error details as follows
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

[tadayosi]

@mmelko Could you have a look?

[jbertram]

Any update on this? I'm looking to get this fixed in ActiveMQ Artemis.

[mmelko]

3.x: #2972
4.x: #2971
main: #2970

[jbertram]

ActiveMQ Artemis is currently using 2.17.6. Will there be a 2.17.7 release with this fix?

[tadayosi]

@jbertram Releasing 2.17.7 soon.