VulnerabilityModified
CVE-2023-33546
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method.
MEDIUM 5.5EPSS 0.33%
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- janino project/janino
- Source
- cve@mitre.org
References
- https://github.com/janino-compiler/janino/issues/201Exploit, Issue Tracking, Third Party Advisory
- https://janino-compiler.github.io/janino/#security
- https://github.com/janino-compiler/janino/issues/201Exploit, Issue Tracking, Third Party Advisory
- https://janino-compiler.github.io/janino/#security
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.