Vulnerability introduced by com.nimbusds:oauth2-oidc-sdk v9.4

[cheenamalhotra]

com.nimbusds:oauth2-oidc-sdk v9.4 depends on net.minidev » json-smart v1.3.3,2.4.2 which introduces below mentioned vulnerability.

azure-activedirectory-library-for-java/pom.xml

Lines 70 to 74 in 72dd774

	<dependency>
	<groupId>com.nimbusds</groupId>
	<artifactId>oauth2-oidc-sdk</artifactId>
	<version>9.4</version>
	</dependency>

Vulnerability details

CVE-2021-31684

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.

Severity

Medium

Recommendation

Upgrade to version net.minidev:json-smart:1.3.3,2.4.5

For ADAL: Upgrade to com.nimbusds:oauth2-oidc-sdk v9.5+