CVE-2023-1370 CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

[Grimoren]

This one was published 14 March 2023

Published Vulnerabilities
CVE-2023-1370 (OSSINDEX) suppress

json-smart - Denial of Service (DoS)
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv2:
Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:
OSSINDEX - [CVE-2023-1370] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1370
OSSIndex - https://ubuntu.com/security/CVE-2023-1370
Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:net.minidev:json-smart:2.4.8:*:*:*:*:*:*:*

Not sure if it's been fixed in the latest(2.4.10), but I see no reference the CVE on the repo

[Grimoren]

Apparently this was already complete for 2.4.9

[UrielCh]

yep... but 2.4.9 introduce a new bug, so skip v2.4.9 and use directly the v2.4.10

[apryamostanov]

I seen this warning in IntelliJ Idea and came here.

I do not understand how "crash" software is a vulnerability.

[UrielCh]

It's more of a potential DDOS helper.