{
  "threat_severity" : "Moderate",
  "public_date" : "2023-03-22T00:00:00Z",
  "bugzilla" : {
    "description" : "jettison: Uncontrolled Recursion in JSONArray",
    "id" : "2182788",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2182788"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-674",
  "details" : [ "An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.", "A flaw was found in Jettison. Infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This issue leads to a StackOverflowError exception being thrown." ],
  "affected_release" : [ {
    "product_name" : "Migration Toolkit for Runtimes 1 on RHEL 8",
    "release_date" : "2023-12-06T00:00:00Z",
    "advisory" : "RHSA-2023:7670",
    "cpe" : "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
    "package" : "mtr/mtr-web-container-rhel8:1.2-9"
  }, {
    "product_name" : "MTA-6.2-RHEL-8",
    "release_date" : "2024-02-28T00:00:00Z",
    "advisory" : "RHSA-2024:1027",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:6.2::el8",
    "package" : "mta/mta-rhel8-operator:6.2.2-3"
  }, {
    "product_name" : "MTA-6.2-RHEL-9",
    "release_date" : "2024-02-28T00:00:00Z",
    "advisory" : "RHSA-2024:1027",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
    "package" : "mta/mta-hub-rhel9:6.2.2-2"
  }, {
    "product_name" : "MTA-6.2-RHEL-9",
    "release_date" : "2024-02-28T00:00:00Z",
    "advisory" : "RHSA-2024:1027",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
    "package" : "mta/mta-operator-bundle:6.2.2-5"
  }, {
    "product_name" : "MTA-6.2-RHEL-9",
    "release_date" : "2024-02-28T00:00:00Z",
    "advisory" : "RHSA-2024:1027",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
    "package" : "mta/mta-pathfinder-rhel9:6.2.2-2"
  }, {
    "product_name" : "MTA-6.2-RHEL-9",
    "release_date" : "2024-02-28T00:00:00Z",
    "advisory" : "RHSA-2024:1027",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
    "package" : "mta/mta-ui-rhel9:6.2.2-2"
  }, {
    "product_name" : "MTA-6.2-RHEL-9",
    "release_date" : "2024-02-28T00:00:00Z",
    "advisory" : "RHSA-2024:1027",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
    "package" : "mta/mta-windup-addon-rhel9:6.2.2-3"
  }, {
    "product_name" : "OCP-Tools-4.13-RHEL-8",
    "release_date" : "2023-06-15T00:00:00Z",
    "advisory" : "RHSA-2023:3622",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.13::el8",
    "package" : "jenkins-2-plugins-0:4.13.1686680473-1.el8"
  }, {
    "product_name" : "OpenShift Developer Tools and Services for OCP 4.11",
    "release_date" : "2023-06-19T00:00:00Z",
    "advisory" : "RHSA-2023:3663",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.11::el8",
    "package" : "jenkins-2-plugins-0:4.11.1686831822-1.el8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform",
    "release_date" : "2023-08-07T00:00:00Z",
    "advisory" : "RHSA-2023:4509",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform::el7",
    "package" : "org.codehaus.jettison/jettison:1.5.4.redhat-00002"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "release_date" : "2023-08-07T00:00:00Z",
    "advisory" : "RHSA-2023:4506",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
    "package" : "eap7-jettison-0:1.5.4-1.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "release_date" : "2023-08-07T00:00:00Z",
    "advisory" : "RHSA-2023:4507",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
    "package" : "eap7-jettison-0:1.5.4-1.redhat_00002.1.el9eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "release_date" : "2023-08-07T00:00:00Z",
    "advisory" : "RHSA-2023:4505",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
    "package" : "eap7-jettison-0:1.5.4-1.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.6.5",
    "release_date" : "2023-08-31T00:00:00Z",
    "advisory" : "RHSA-2023:4924",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7.6.5",
    "package" : "jettison"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.6 for RHEL 7",
    "release_date" : "2023-08-31T00:00:00Z",
    "advisory" : "RHSA-2023:4918",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7",
    "package" : "rh-sso7-keycloak-0:18.0.9-1.redhat_00001.1.el7sso"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.6 for RHEL 8",
    "release_date" : "2023-08-31T00:00:00Z",
    "advisory" : "RHSA-2023:4919",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8",
    "package" : "rh-sso7-keycloak-0:18.0.9-1.redhat_00001.1.el8sso"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.6 for RHEL 9",
    "release_date" : "2023-08-31T00:00:00Z",
    "advisory" : "RHSA-2023:4920",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9",
    "package" : "rh-sso7-keycloak-0:18.0.9-1.redhat_00001.1.el9sso"
  }, {
    "product_name" : "RHEL-8 based Middleware Containers",
    "release_date" : "2023-08-31T00:00:00Z",
    "advisory" : "RHSA-2023:4921",
    "cpe" : "cpe:/a:redhat:rhosemc:1.0::el8",
    "package" : "rh-sso-7/sso76-openshift-rhel8:7.6-27"
  }, {
    "product_name" : "RHINT Camel-Q 2.13.3",
    "release_date" : "2023-06-19T00:00:00Z",
    "advisory" : "RHSA-2023:3667",
    "cpe" : "cpe:/a:redhat:camel_quarkus:2.13",
    "package" : "jettison"
  }, {
    "product_name" : "RHINT Camel-Springboot 3.18.3.P2",
    "release_date" : "2023-06-15T00:00:00Z",
    "advisory" : "RHSA-2023:3641",
    "cpe" : "cpe:/a:redhat:camel_spring_boot:3.18"
  }, {
    "product_name" : "RHINT Camel-Springboot 3.20.1",
    "release_date" : "2023-05-03T00:00:00Z",
    "advisory" : "RHSA-2023:2100",
    "cpe" : "cpe:/a:redhat:camel_spring_boot:3.20.1",
    "package" : "jettison"
  } ],
  "package_state" : [ {
    "product_name" : "A-MQ Clients 2",
    "fix_state" : "Not affected",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:a_mq_clients:2"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-logging/elasticsearch6-rhel8",
    "cpe" : "cpe:/a:redhat:logging:5"
  }, {
    "product_name" : "Red Hat Data Grid 8",
    "fix_state" : "Not affected",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:8"
  }, {
    "product_name" : "Red Hat Decision Manager 7",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "log4j:2/log4j",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "log4j",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Red Hat Integration Camel K 1",
    "fix_state" : "Affected",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:integration:1"
  }, {
    "product_name" : "Red Hat JBoss Data Grid 7",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:7"
  }, {
    "product_name" : "Red Hat JBoss Data Virtualization 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_data_virtualization:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "eap6-jettison",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossas-modules-eap",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jboss-on",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "keycloak-adapter-eap6",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "keycloak-adapter-sso7_2-eap6",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "keycloak-adapter-sso7_3-eap6",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "keycloak-adapter-sso7_4-eap6",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "keycloak-adapter-sso7_5-eap6",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Not affected",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Will not fix",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6"
  }, {
    "product_name" : "Red Hat JBoss Fuse Service Works 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_fuse_service_works:6"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Out of support scope",
    "package_name" : "jenkins-2-plugins",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "jenkins-2-plugins",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Out of support scope",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
  }, {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Not affected",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:satellite:6"
  }, {
    "product_name" : "streams for Apache Kafka",
    "fix_state" : "Not affected",
    "package_name" : "jettison",
    "cpe" : "cpe:/a:redhat:amq_streams:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-1436\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-1436\nhttps://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/" ],
  "name" : "CVE-2023-1436",
  "csaw" : false
}