Skip to content

Commit 14391dd

Browse files
octonatooctonato
committed
json cve announcements
1 parent 25c7c99 commit 14391dd

4 files changed

Lines changed: 123 additions & 2 deletions

File tree

‎app/views/vulnerabilities.scala.html‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,32 @@ <h2>Reporting vulnerabilities</h2>
2727

2828
<h2>Play 2.8.x<h2>
2929

30+
<h3>Fixed in Play 2.8.3</h3>
31+
<ul>
32+
<li><a href="@routes.Security.vulnerability("CVE-2020-26882-JsonParseDataAmplification")">CVE-2020-26882-yyyyyy</a> - JSON parse Data Amplification</li>
33+
<li><a href="@routes.Security.vulnerability("CVE-2020-26883-JsonParseUncontrolledRecursion")">CVE-2020-26883-JsonParseUncontrolledRecursion</a> - JSON parse Uncontrolled Recursion</li>
34+
<li><a href="@routes.Security.vulnerability("CVE-2020-27196-DosViaJsonStackOverflow")">CVE-2020-27196-DosViaJsonStackOverflow</a> - DoS via JSON parse Stack Overflow</li>
35+
</ul>
36+
3037
<h3>Fixed in Play 2.8.2</h3>
3138
<ul>
3239
<a href="@routes.Security.vulnerability("CVE-2020-12480-CsrfBlacklistBypass")">CVE-2020-12480-CsrfBlacklistBypass</a> - Play CSRF Filter Content-Type black list bypass
3340
</ul>
34-
41+
3542
<h2>Play 2.7.x<h2>
3643

44+
<h3>Fixed in Play 2.7.6</h3>
45+
<ul>
46+
<li><a href="@routes.Security.vulnerability("CVE-2020-26882-JsonParseDataAmplification")">CVE-2020-26882-JsonParseDataAmplification</a> - JSON parse Data Amplification</li>
47+
<li><a href="@routes.Security.vulnerability("CVE-2020-26883-JsonParseUncontrolledRecursion")">CVE-2020-26883-JsonParseUncontrolledRecursion</a> - JSON parse Uncontrolled Recursion</li>
48+
<li><a href="@routes.Security.vulnerability("CVE-2020-27196-DosViaJsonStackOverflow")">CVE-2020-27196-DosViaJsonStackOverflow</a> - DoS via JSON parse Stack Overflow</li>
49+
</ul>
50+
3751
<h3>Fixed in Play 2.7.5</h3>
3852
<ul>
3953
<a href="@routes.Security.vulnerability("CVE-2020-12480-CsrfBlacklistBypass")">CVE-2020-12480-CsrfBlacklistBypass</a> - Play CSRF Filter Content-Type black list bypass
4054
</ul>
41-
55+
4256
<h2>Play 2.6.x<h2>
4357

4458
<h3>Fixed in Play 2.6.24</h3>

‎public/markdown/vulnerabilities/CVE-2020-26882-JsonParseDataAmplification.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# JSON parse Data Amplification
2+
3+
## CVE-ID
4+
5+
CVE-2020-26882
6+
7+
## Date
8+
9+
1 October 2020
10+
11+
## Description
12+
13+
Carefully crafted JSON payloads sent as a form field lead to Data Amplification.
14+
15+
## Impact
16+
17+
Affects users that accept JSON as a field of a Form upload (multipart/form-data).
18+
19+
## Affected versions
20+
21+
- Play 2.8.0-2.8.2
22+
- Play 2.7.0-2.7.5
23+
- Play 2.6.x
24+
25+
## Fixes
26+
27+
This issue is fixed on Play 2.8.3 and 2.7.6. There won’t be a 2.6.x release with this fix since this version has reached end-of-life, please
28+
upgrade as soon as possible to avoid this security issue.
29+
30+
## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
31+
32+
**Overall: 6.7**
33+
[AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1)
34+
35+
## Acknowledgements
36+
37+
Credit for finding this vulnerability goes to The Gemini Security Team, Doyensec and @lucash-dev.

‎public/markdown/vulnerabilities/CVE-2020-26883-JsonParseUncontrolledRecursion.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# JSON parse Uncontrolled Recursion
2+
3+
## CVE-ID
4+
5+
CVE-2020-26883
6+
7+
## Date
8+
9+
1 October 2020
10+
11+
## Description
12+
13+
Carefully crafted JSON payloads sent as a form field lead to Uncontrolled Recursion.
14+
15+
## Impact
16+
17+
This only impacts Play applications implemented using the `PlayJava` flavor.
18+
19+
## Affected versions
20+
21+
- Play 2.8.0-2.8.2
22+
- Play 2.7.0-2.7.5
23+
- Play 2.6.x
24+
25+
## Fixes
26+
27+
This issue is fixed on Play 2.8.3 and 2.7.6. There won’t be a 2.6.x release with this fix since this version has reached end-of-life, please
28+
upgrade as soon as possible to avoid this security issue.
29+
30+
## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
31+
32+
**Overall: 6.7**
33+
[AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1)
34+
35+
## Acknowledgements
36+
37+
Credit for finding this vulnerability goes to The Gemini Security Team, Doyensec and @lucash-dev.

‎public/markdown/vulnerabilities/CVE-2020-27196-DosViaJsonStackOverflow.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# DoS via JSON parse Stack Overflow
2+
3+
## CVE-ID
4+
5+
CVE-2020-27196
6+
7+
## Date
8+
9+
1 October 2020
10+
11+
## Description
12+
13+
Play body parsing of HTTP requests eagerly parses a payload given a `Content-Type` header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a `StackOverflowError`.
14+
15+
## Impact
16+
17+
This only impacts Play applications implemented using the `PlayJava` flavor.
18+
19+
## Affected versions
20+
21+
- Play 2.8.0-2.8.2
22+
- Play 2.7.0-2.7.5
23+
- Play 2.6.x
24+
25+
## Fixes
26+
27+
This issue is fixed on Play 2.8.3 and 2.7.6. There won’t be a 2.6.x release with this fix since this version has reached end-of-life, please
28+
upgrade as soon as possible to avoid this security issue.
29+
30+
## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
31+
32+
**Overall: 7.0**
33+
[AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C&version=3.1)

0 commit comments

Comments
 (0)