Skip to:
Upgrade hazelcast from 5.3.2 to >= 5.3.5.
hazelcast 5.3.2 contains relocated org.json:json:20230227:https://github.com/hazelcast/hazelcast/blob/v5.3.2/hazelcast/pom.xml#L515https://github.com/hazelcast/hazelcast/blob/v5.3.2/hazelcast/pom.xml#L191-L198
org.json:json:20230227 is vulnerable, a bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used: https://nvd.nist.gov/vuln/detail/CVE-2023-5072
hazelcast 5.3.5 with everit-json-schema:1.14.3 with the fix has been released:https://github.com/hazelcast/hazelcast/commits/v5.3.5
To prevent out of memory (OOM) issues and attacks please upgrade hazelcast.
Works for me on Poppy bugfest environment.
Deployed to the Poppy bf env. Moved status to In bugfix review from status Awaiting deployment. Please proceed with the verification.
Upgrade hazelcast from 5.3.2 to >= 5.3.5.
hazelcast 5.3.2 contains relocated org.json:json:20230227:
https://github.com/hazelcast/hazelcast/blob/v5.3.2/hazelcast/pom.xml#L515
https://github.com/hazelcast/hazelcast/blob/v5.3.2/hazelcast/pom.xml#L191-L198
org.json:json:20230227 is vulnerable, a bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used: https://nvd.nist.gov/vuln/detail/CVE-2023-5072
hazelcast 5.3.5 with everit-json-schema:1.14.3 with the fix has been released:
https://github.com/hazelcast/hazelcast/commits/v5.3.5
To prevent out of memory (OOM) issues and attacks please upgrade hazelcast.