Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-z7rn-5t92-jyem

Summary

Uncontrolled Resource Consumption
Decoding invalid JSON data can cause the JVM to hang in an infinite loop leading to a Denial of Service and high CPU consumption.

Aliases

alias	GMS-2023-1112

Fixed_packages

url pkg:maven/org.json/json@20200518

purl pkg:maven/org.json/json@20200518

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20200518

Affected_packages

url pkg:maven/org.json/json@20070829

purl pkg:maven/org.json/json@20070829

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20070829

url pkg:maven/org.json/json@20080701

purl pkg:maven/org.json/json@20080701

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20080701

url pkg:maven/org.json/json@20090211

purl pkg:maven/org.json/json@20090211

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20090211

url pkg:maven/org.json/json@20131018

purl pkg:maven/org.json/json@20131018

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20131018

url pkg:maven/org.json/json@20140107

purl pkg:maven/org.json/json@20140107

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20140107

url pkg:maven/org.json/json@20141113

purl pkg:maven/org.json/json@20141113

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20141113

url pkg:maven/org.json/json@20150729

purl pkg:maven/org.json/json@20150729

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20150729

url pkg:maven/org.json/json@20151123

purl pkg:maven/org.json/json@20151123

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20151123

url pkg:maven/org.json/json@20160212

purl pkg:maven/org.json/json@20160212

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20160212

url pkg:maven/org.json/json@20160807

purl pkg:maven/org.json/json@20160807

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20160807

url pkg:maven/org.json/json@20160810

purl pkg:maven/org.json/json@20160810

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20160810

url pkg:maven/org.json/json@20170516

purl pkg:maven/org.json/json@20170516

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20170516

url pkg:maven/org.json/json@20171018

purl pkg:maven/org.json/json@20171018

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-kskh-z2dm-nkg5

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20171018

url pkg:maven/org.json/json@20180130

purl pkg:maven/org.json/json@20180130

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20180130

url pkg:maven/org.json/json@20180813

purl pkg:maven/org.json/json@20180813

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20180813

url pkg:maven/org.json/json@20190722

purl pkg:maven/org.json/json@20190722

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-32wz-1tnx-5qep

vulnerability	VCID-41pg-3cdb-jqee

vulnerability	VCID-5xm4-tyx3-wudu

vulnerability	VCID-m8tp-xd4z-d3g7

vulnerability	VCID-tp9p-km7u-wbd5

vulnerability	VCID-z7rn-5t92-jyem

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.json/json@20190722

References

reference_url	https://github.com/stleary/JSON-java/issues/484
reference_id
reference_type
scores
url	https://github.com/stleary/JSON-java/issues/484

reference_url	https://github.com/stleary/JSON-java/pull/485
reference_id
reference_type
scores
url	https://github.com/stleary/JSON-java/pull/485

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability 0.5

Weighted_severity 0.0

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z7rn-5t92-jyem

Vulnerability Instance