CVE-2024-21634 (High) detected in ion-java-1.0.2.jar, ion-java-1.9.5.jar

[mend-for-github-com]

CVE-2024-21634 - High Severity Vulnerability

Vulnerable Libraries - ion-java-1.0.2.jar, ion-java-1.9.5.jar

ion-java-1.0.2.jar

A Java implementation of the Amazon Ion data notation.

Library home page: https://github.com/amznlabs/ion-java/

Path to dependency file: /data-prepper-plugins/kafka-plugins/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/software.amazon.ion/ion-java/1.0.2/ee9dacea7726e495f8352b81c12c23834ffbc564/ion-java-1.0.2.jar

Dependency Hierarchy:

• schema-registry-serde-1.1.15.jar (Root Library)
  • aws-java-sdk-sts-1.12.151.jar
    • aws-java-sdk-core-1.12.151.jar
      • ❌ ion-java-1.0.2.jar (Vulnerable Library)

ion-java-1.9.5.jar

A Java implementation of the Amazon Ion data notation.

Path to dependency file: /release/archives/linux/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.amazon.ion/ion-java/1.9.5/42becac25189163db3393f93c455a4db92d3029b/ion-java-1.9.5.jar

Dependency Hierarchy:

• jackson-dataformat-ion-2.15.3.jar (Root Library)
  • ❌ ion-java-1.9.5.jar (Vulnerable Library)

Found in HEAD commit: 774fa213614252c4772b018731452f020cafa16a

Found in base branch: main

Vulnerability Details

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then invoke certain IonValue methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the IonValue model, results in a StackOverflowError originating from the ion-java library. The patch is included in ion-java 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.

Publish Date: 2024-01-03

URL: CVE-2024-21634

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-264p-99wq-f4j6

Release Date: 2024-01-03

Fix Resolution: com.amazon.ion:ion-java:1.10.5

[dlvenable]

This hasn't been release yet, but we should fix this vulnerability before releasing 2.7.