CVE & CISA-KEV CatalogNVD
CVE-2023-1370
HIGH7.5
CVSS v3
Description
Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
How to fix
Remediation Available
json-smartDebian
Fixed in:2.2-2+deb11u1CVE-2023-1370
Fixed in:2.2-2+deb12u1CVE-2023-1370
Fixed in:2.2-3CVE-2023-1370
Fixed in:2.2-3CVE-2023-1370
cri-oRed Hat / RHEL
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el7RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el7RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
cri-oRocky
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el7RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el7RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
cri-o-debuginfoRocky
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el7RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
cri-o-debuginfoRed Hat / RHEL
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el7RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
cri-o-debugsourceRocky
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
cri-o-debugsourceRed Hat / RHEL
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
Fixed in:0:1.23.5-15.rhaos4.10.git0bbb0d9.el8RHSA-2023:3362
jenkinsRocky
Fixed in:0:2.401.1.1686831596-3.el8RHSA-2023:3663
Fixed in:0:2.401.1.1686831596-3.el8RHSA-2023:3663
Fixed in:0:2.401.1.1686680404-3.el8RHSA-2023:3622
Fixed in:0:2.401.1.1686680404-3.el8RHSA-2023:3622
Fixed in:0:2.401.1.1686649641-3.el8RHSA-2023:3610
Fixed in:0:2.401.1.1686649641-3.el8RHSA-2023:3610
jenkinsRed Hat / RHEL
Fixed in:0:2.401.1.1686649641-3.el8RHSA-2023:3610
Fixed in:0:2.401.1.1686680404-3.el8RHSA-2023:3622
Fixed in:0:2.401.1.1686680404-3.el8RHSA-2023:3622
Fixed in:0:2.401.1.1686831596-3.el8RHSA-2023:3663
Fixed in:0:2.401.1.1686831596-3.el8RHSA-2023:3663
Fixed in:0:2.401.1.1686649641-3.el8RHSA-2023:3610
jenkins-2-pluginsRocky
Fixed in:0:4.10.1684982411-1.el8RHSA-2023:3362
Fixed in:0:4.13.1686680473-1.el8RHSA-2023:3622
Fixed in:0:4.13.1686680473-1.el8RHSA-2023:3622
Fixed in:0:4.10.1684982411-1.el8RHSA-2023:3362
Fixed in:0:4.12.1686649756-1.el8RHSA-2023:3610
Fixed in:0:4.11.1686831822-1.el8RHSA-2023:3663
Fixed in:0:4.11.1686831822-1.el8RHSA-2023:3663
Fixed in:0:4.12.1686649756-1.el8RHSA-2023:3610
jenkins-2-pluginsRed Hat / RHEL
Fixed in:0:4.13.1686680473-1.el8RHSA-2023:3622
Fixed in:0:4.10.1684982411-1.el8RHSA-2023:3362
Fixed in:0:4.12.1686649756-1.el8RHSA-2023:3610
Fixed in:0:4.13.1686680473-1.el8RHSA-2023:3622
Fixed in:0:4.11.1686831822-1.el8RHSA-2023:3663
Fixed in:0:4.11.1686831822-1.el8RHSA-2023:3663
Fixed in:0:4.10.1684982411-1.el8RHSA-2023:3362
Fixed in:0:4.12.1686649756-1.el8RHSA-2023:3610
python-sushyRed Hat / RHEL
Fixed in:0:4.1.6-0.20230517173625.5490eb6.el8RHSA-2023:3362
python-sushyRocky
Fixed in:0:4.1.6-0.20230517173625.5490eb6.el8RHSA-2023:3362
python3-sushyRed Hat / RHEL
Fixed in:0:4.1.6-0.20230517173625.5490eb6.el8RHSA-2023:3362
python3-sushyRocky
Fixed in:0:4.1.6-0.20230517173625.5490eb6.el8RHSA-2023:3362
python3-sushy-testsRed Hat / RHEL
Fixed in:0:4.1.6-0.20230517173625.5490eb6.el8RHSA-2023:3362
python3-sushy-testsRocky
Fixed in:0:4.1.6-0.20230517173625.5490eb6.el8RHSA-2023:3362
json-smartUbuntu
Fixed in:2.2-2ubuntu0.18.04.1USN-6011-1
Fixed in:2.2-2ubuntu0.20.04.1USN-6011-1
Fixed in:2.2-2ubuntu0.22.04.1USN-6011-1
Fixed in:2.2-2ubuntu0.22.10.1USN-6011-1
libjson-smart-javaUbuntu
Fixed in:2.2-2ubuntu0.18.04.1USN-6011-1
Fixed in:2.2-2ubuntu0.20.04.1USN-6011-1
Fixed in:2.2-2ubuntu0.22.04.1USN-6011-1
Fixed in:2.2-2ubuntu0.22.10.1USN-6011-1
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploit Intelligence
1.12%probability of exploitation in 30 days
62ndpercentile
Moderate risk: more likely to be exploited than 62% of all known CVEs.
References
Exploit1
Other references1
Related Vulnerabilities
Other CWE-674 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2021-45105 | Medium | 5.9 | 100% | - | Fix |
| CVE-2024-25111 | High | 8.6 | 65% | - | Fix |
| CVE-2023-50269 | High | 8.6 | 58% | - | Fix |
| CVE-2021-42697 | High | 7.5 | 36% | - | Fix |
| CVE-2018-0739 | Medium | 6.5 | 19% | - | Fix |
| CVE-2007-1285 | High | 7.5 | 18% | - | Fix |
Embed a live status badge for CVE-2023-1370
Markdown
[](https://tridentstack.com/cve/CVE-2023-1370)HTML
<a href="https://tridentstack.com/cve/CVE-2023-1370"><img src="https://tridentstack.com/cve/badge/CVE-2023-1370.svg" alt="CVE-2023-1370"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-02-13.