Skip to content

Commit ca7aeed

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-vc89-hccf-rq55 GHSA-g239-q96q-x4qm
1 parent 3927ab0 commit ca7aeed

File tree

2 files changed

+400
-3
lines changed

2 files changed

+400
-3
lines changed

‎advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json‎

Lines changed: 326 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vc89-hccf-rq55",
4-
"modified": "2022-01-06T20:19:30Z",
4+
"modified": "2025-12-16T22:29:13Z",
55
"published": "2022-01-06T23:48:35Z",
66
"aliases": [
77
"CVE-2022-21653"
88
],
99
"summary": "Hash collision in typelevel jawn",
10-
"details": "### Impact\n\nExtenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:\n\nAffected implementations include:\n* `org.http4s` :: `http4s-play-json`\n* `org.typelevel :: jawn-ast` (< 0.8.0)\n* `org.typelevel :: jawn-play` (discontinued)\n* `org.typelevel :: jawn-rojoma` (discontinued)\n* `org.typelevel :: jawn-spray` (discontinued)\n\nUnaffected implementations include:\n* `io.argonaut :: argonaut-jawn`\n* `io.circe :: circe-parser`\n* `org.typelevel :: jawn-ast` (>= 0.8.0)\n* `org.typelevel :: jawn-json4s` (discontinued)\n* `org.typelevel :: jawn-argonaut` (discontinued)\n\n### Patches\n\n`jawn-parser-1.3.2` fixes the issue.\n\n### Workarounds\n\nOverride `objectContext()` to use a collision-safe collection. See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.\n\n### References\n\n* https://github.com/typelevel/jawn/pull/390\n\n### Credits\n\n* @kag0, for the report and the patch\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)\n* E-mail a maintainer:\n * [@rossabaker](mailto:[email protected])\n",
10+
"details": "### Impact\n\nExtenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:\n\nAffected implementations include:\n* `org.http4s` :: `http4s-play-json`\n* `org.typelevel :: jawn-ast` (< 0.8.0)\n* `org.typelevel :: jawn-play` (discontinued)\n* `org.typelevel :: jawn-rojoma` (discontinued)\n* `org.typelevel :: jawn-spray` (discontinued)\n\nUnaffected implementations include:\n* `io.argonaut :: argonaut-jawn`\n* `io.circe :: circe-parser`\n* `org.typelevel :: jawn-ast` (>= 0.8.0)\n* `org.typelevel :: jawn-json4s` (discontinued)\n* `org.typelevel :: jawn-argonaut` (discontinued)\n\n### Patches\n\n`jawn-parser-1.3.2` fixes the issue.\n\n### Workarounds\n\nOverride `objectContext()` to use a collision-safe collection. See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.\n\n### References\n\n* https://github.com/typelevel/jawn/pull/390\n\n### Credits\n\n* @kag0, for the report and the patch\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)\n* E-mail a maintainer:\n * [@rossabaker](mailto:[email protected])",
1111
"severity": [
1212
{
1313
"type": "CVSS_V3",
@@ -18,7 +18,216 @@
1818
{
1919
"package": {
2020
"ecosystem": "Maven",
21-
"name": "org.typelevel:jawn-parser"
21+
"name": "org.typelevel:jawn-parser_0.25"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
}
30+
]
31+
}
32+
],
33+
"database_specific": {
34+
"last_known_affected_version_range": "< 1.3.2"
35+
}
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.typelevel:jawn-parserg"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
}
49+
]
50+
}
51+
],
52+
"database_specific": {
53+
"last_known_affected_version_range": "< 1.3.2"
54+
}
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.typelevel:jawn-parser_0.27"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
}
68+
]
69+
}
70+
],
71+
"database_specific": {
72+
"last_known_affected_version_range": "< 1.3.2"
73+
}
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.typelevel:jawn-parser_2.10"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "0"
86+
}
87+
]
88+
}
89+
],
90+
"database_specific": {
91+
"last_known_affected_version_range": "< 1.3.2"
92+
}
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Maven",
97+
"name": "org.typelevel:jawn-parser_2.11"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "0"
105+
}
106+
]
107+
}
108+
],
109+
"database_specific": {
110+
"last_known_affected_version_range": "< 1.3.2"
111+
}
112+
},
113+
{
114+
"package": {
115+
"ecosystem": "Maven",
116+
"name": "org.typelevel:jawn-parser_2.12"
117+
},
118+
"ranges": [
119+
{
120+
"type": "ECOSYSTEM",
121+
"events": [
122+
{
123+
"introduced": "0"
124+
},
125+
{
126+
"fixed": "1.3.2"
127+
}
128+
]
129+
}
130+
]
131+
},
132+
{
133+
"package": {
134+
"ecosystem": "Maven",
135+
"name": "org.typelevel:jawn-parser_2.13"
136+
},
137+
"ranges": [
138+
{
139+
"type": "ECOSYSTEM",
140+
"events": [
141+
{
142+
"introduced": "0"
143+
},
144+
{
145+
"fixed": "1.3.2"
146+
}
147+
]
148+
}
149+
]
150+
},
151+
{
152+
"package": {
153+
"ecosystem": "Maven",
154+
"name": "org.typelevel:jawn-parser_2.13.0-M5"
155+
},
156+
"ranges": [
157+
{
158+
"type": "ECOSYSTEM",
159+
"events": [
160+
{
161+
"introduced": "0"
162+
}
163+
]
164+
}
165+
],
166+
"database_specific": {
167+
"last_known_affected_version_range": "< 1.3.2"
168+
}
169+
},
170+
{
171+
"package": {
172+
"ecosystem": "Maven",
173+
"name": "org.typelevel:jawn-parser_2.13.0-RC1"
174+
},
175+
"ranges": [
176+
{
177+
"type": "ECOSYSTEM",
178+
"events": [
179+
{
180+
"introduced": "0"
181+
}
182+
]
183+
}
184+
],
185+
"database_specific": {
186+
"last_known_affected_version_range": "< 1.3.2"
187+
}
188+
},
189+
{
190+
"package": {
191+
"ecosystem": "Maven",
192+
"name": "org.typelevel:jawn-parser_2.13.0-RC2"
193+
},
194+
"ranges": [
195+
{
196+
"type": "ECOSYSTEM",
197+
"events": [
198+
{
199+
"introduced": "0"
200+
}
201+
]
202+
}
203+
],
204+
"database_specific": {
205+
"last_known_affected_version_range": "< 1.3.2"
206+
}
207+
},
208+
{
209+
"package": {
210+
"ecosystem": "Maven",
211+
"name": "org.typelevel:jawn-parser_2.13.0-RC3"
212+
},
213+
"ranges": [
214+
{
215+
"type": "ECOSYSTEM",
216+
"events": [
217+
{
218+
"introduced": "0"
219+
}
220+
]
221+
}
222+
],
223+
"database_specific": {
224+
"last_known_affected_version_range": "< 1.3.2"
225+
}
226+
},
227+
{
228+
"package": {
229+
"ecosystem": "Maven",
230+
"name": "org.typelevel:jawn-parser_3"
22231
},
23232
"ranges": [
24233
{
@@ -33,6 +242,120 @@
33242
]
34243
}
35244
]
245+
},
246+
{
247+
"package": {
248+
"ecosystem": "Maven",
249+
"name": "org.typelevel:jawn-parser_3.0.0-M1"
250+
},
251+
"ranges": [
252+
{
253+
"type": "ECOSYSTEM",
254+
"events": [
255+
{
256+
"introduced": "0"
257+
}
258+
]
259+
}
260+
],
261+
"database_specific": {
262+
"last_known_affected_version_range": "< 1.3.2"
263+
}
264+
},
265+
{
266+
"package": {
267+
"ecosystem": "Maven",
268+
"name": "org.typelevel:jawn-parser_3.0.0-M2"
269+
},
270+
"ranges": [
271+
{
272+
"type": "ECOSYSTEM",
273+
"events": [
274+
{
275+
"introduced": "0"
276+
}
277+
]
278+
}
279+
],
280+
"database_specific": {
281+
"last_known_affected_version_range": "< 1.3.2"
282+
}
283+
},
284+
{
285+
"package": {
286+
"ecosystem": "Maven",
287+
"name": "org.typelevel:jawn-parser_3.0.0-M3"
288+
},
289+
"ranges": [
290+
{
291+
"type": "ECOSYSTEM",
292+
"events": [
293+
{
294+
"introduced": "0"
295+
}
296+
]
297+
}
298+
],
299+
"database_specific": {
300+
"last_known_affected_version_range": "< 1.3.2"
301+
}
302+
},
303+
{
304+
"package": {
305+
"ecosystem": "Maven",
306+
"name": "org.typelevel:jawn-parser_3.0.0-RC1"
307+
},
308+
"ranges": [
309+
{
310+
"type": "ECOSYSTEM",
311+
"events": [
312+
{
313+
"introduced": "0"
314+
}
315+
]
316+
}
317+
],
318+
"database_specific": {
319+
"last_known_affected_version_range": "< 1.3.2"
320+
}
321+
},
322+
{
323+
"package": {
324+
"ecosystem": "Maven",
325+
"name": "org.typelevel:jawn-parser_3.0.0-RC2"
326+
},
327+
"ranges": [
328+
{
329+
"type": "ECOSYSTEM",
330+
"events": [
331+
{
332+
"introduced": "0"
333+
}
334+
]
335+
}
336+
],
337+
"database_specific": {
338+
"last_known_affected_version_range": "< 1.3.2"
339+
}
340+
},
341+
{
342+
"package": {
343+
"ecosystem": "Maven",
344+
"name": "org.typelevel:jawn-parser_3.0.0-RC3"
345+
},
346+
"ranges": [
347+
{
348+
"type": "ECOSYSTEM",
349+
"events": [
350+
{
351+
"introduced": "0"
352+
}
353+
]
354+
}
355+
],
356+
"database_specific": {
357+
"last_known_affected_version_range": "< 1.3.2"
358+
}
36359
}
37360
],
38361
"references": [

0 commit comments

Comments
 (0)